About this role
We are looking for an engineer who will own the end-to-end evaluation, design, and implementation of security and observability solutions for a container-based private cloud platform. This role spans the full lifecycle — from architectural research and tool selection through production deployment and ongoing operations — across unified telemetry, security detection, vulnerability management, supply chain security, and automated incident response.
You will be the technical owner of the platform's observability and security monitoring stack, working across platform engineering, security operations, and SRE teams to deliver a unified telemetry-first architecture.
What will you do?
Evaluation & Research
Conduct structured evaluation of candidate tools against criteria including licence compliance, community governance, vendor independence, and technical fitnessPerform proof-of-concept exercises to validate architectural decisions (e.g. ingestion throughput, storage efficiency, query latency, operational complexity)Assess and track governance posture of selected tools; maintain contingency paths for vendor-led dependenciesEngage with upstream open-source communities and foundations to stay current on project maturity and roadmap changes
Design & Architecture
Design unified telemetry pipelines using open standards to serve both SRE observability and security operations from a single data layerArchitect security detection workflows using vendor-neutral detection languages to ensure portability of detection content across backendsDesign vulnerability aggregation and management workflows spanning container scanning, software composition analysis, static analysis, infrastructure vulnerability scanning, and software bill of materials generationDesign supply chain security controls including image signing, provenance attestation, and registry policy enforcementDesign exposure path analysis using graph-based tooling to map relationships across compute orchestration, identity, source control, and vulnerability dataDesign automated remediation and orchestration workflows integrated with alerting, ChatOps, and ticketingProduce and maintain architecture decision records documenting design rationale, trade-offs, and change history
Implementation & Operations
Deploy and operate the observability stack: telemetry collection, columnar storage, dashboarding, metrics scraping, alerting, and log routingDeploy and operate the security monitoring stack: endpoint/host-based detection, detection rule evaluation, vulnerability aggregation, and infrastructure scanningDeploy and operate CI pipeline security scanning: container image scanning, dependency scanning, SBOM generation, static analysis, infrastructure-as-code scanning, and secrets detectionImplement image registry security with integrated vulnerability scanning and admission policy enforcementImplement identity, directory, secrets management, and certificate lifecycle infrastructureImplement collaboration and incident management tooling (ChatOps, ticketing)Build and maintain detection rules, alerting rules, and automation playbooksOperate all components on a container orchestration platform with fleet-wide deployment tooling
Process & Governance
Define and document operational runbooks for each capability areaEstablish and maintain vendor-independence contingency entries for all vendor-led toolsConduct periodic licence and governance re-assessment of selected toolsCollaborate with legal/compliance on copyleft licence reviews before deploymentDefine SLOs for telemetry pipeline availability, ingestion latency, and detection coverageParticipate in security incident response using the tooling you build and operate
Bachelor's degree in Computer Science, Cybersecurity, Information Systems, or equivalent practical experienceRelevant certifications are a plus but not required (e.g. Kubernetes security, Linux administration, offensive security, or cloud security specialisations)5+ years in platform engineering, SRE, or security engineering rolesStrong hands-on experience with at least 3 of the following:Telemetry collection frameworks and instrumentation standardsColumnar or analytical databases for log/trace/event storageMetrics scraping and alerting ecosystemsSIEM operations and detection engineering (vendor-neutral detection rule formats preferred)Search-based log analytics platforms (to understand migration context)Production experience deploying and operating on Kubernetes or equivalent container orchestration platformsExperience with container security scanning and software composition analysis toolingFamiliarity with supply chain security concepts: SBOM, image signing, provenance attestation, admission controlExperience with at least one SOAR or automation/orchestration platformSolid understanding of log collection and routing architecturesExperience writing detection rules or correlation logic for security monitoringAbility to evaluate open-source projects for governance health, licence risk, and production readinessStrong Linux systems fundamentalsExperience with host-based intrusion detection or endpoint detection and response toolingExperience with graph databases and asset/infrastructure relationship mappingFamiliarity with vulnerability management and aggregation platformsExperience with identity providers, directory services, and secrets managementContributions to open-source security or observability projectsExperience operating in government or regulated environments with strict vendor-independence or sovereignty requirementsFamiliarity with enterprise Linux and container platform ecosystemsExperience with GitOps workflows for deploying infrastructure servicesStatic/dynamic application security testing tooling experience We are driven by our AEIOU beliefs—Adventure, Excellence, Integrity, Ownership, and Unity—and we seek individuals who embody these values in both their professional and personal lives. We are committed to our Impact: Valuing our clients, Growing our people, and Creating our future.
Together, we make the extraordinary happen.
Learn more about us at ncs.co and visit our LinkedIn career site.
Scam Alert
We are aware of fraudulent job offers and impersonations of NCS recruiters. Phishing emails using convincing-looking but fake addresses are also commonly used to trick you into thinking that they come from official NCS sources.
Please note that all official communications from NCS Group will only be sent from verified corporate email addresses. Always check that the sender’s email address ends with the genuine NCS domain, @ncs.com.sg and beware of extra letters, symbols or misspellings. When in doubt, verify the sender’s identity by contacting us at [email protected].