Security Operations Engineer

COMPANY DESCRIPTION YTL PowerSeraya Pte. Limited, a wholly owned subsidiary of YTL Power International Berhad, is in the business of producing, wholesaling, trading and retailing of energy; with a primary focus on electricity. As an established player in Singapore's energy sector, it supplies the country's energy needs through its multi-utilities platform. With a licensed generation capacity of 3,100 MW*, it is one of Singapore's largest electricity generators. The YTL PowerSeraya Group has three subsidiaries: the retail arm under the Geneco brand provides electricity price plans and energy solutions to homes and businesses, PetroSeraya is the fuel management arm of the Group, and Taser Power which operates Taser Power Plant. Besides being a Plaque of Commendation (GOLD) awardee at the National Trade Union Congress's May Day Awards 2023, YTL PowerSeraya has adopted four Tripartite Standards under the Tripartite Alliance for Fair and Progressive Employment Practices, and has committed to be a fair and progressive employer. To find out more about the organisation, please visit ytlpowerseraya.com. *As at 4 February 2026, our registered generating capacity with EMA is 2,487 MW. RESPONSIBILITIES We are seeking a motivated and detail-oriented Security Operations Engineer to join our Infrastructure Operations & Cyber Security team. This role is responsible for supporting day-to-day security operations across Azure and on-premises environments, with a focus on security event investigation, endpoint protection, vulnerability management, security monitoring, and cyber awareness initiatives. The successful candidate will work closely with internal technology teams, managed security service providers, vendors, and business stakeholders to investigate security events, improve cyber resilience, maintain operational security controls, and contribute to the continuous enhancement of the organisation's security posture. KEY RESPONSIBILITIES Security Engineering & Hardening • Support the implementation, maintenance, and continuous improvement of security controls across infrastructure and cloud environments. • Assist with onboarding and validating security log sources into approved SIEM platforms. • Support detection tuning, security configuration reviews, and monitoring improvements. • Evaluate and implement security technologies that strengthen the organisation's cyber defence capabilities. • Support the deployment and maintenance of security hardening standards across Windows, Linux, Microsoft 365, and Azure environments. • Ensure controls align with CIS Benchmarks and industry-recognised security best practices. Vulnerability Management & Threat Advisory • Coordinate vulnerability assessment activities for critical infrastructure and servers. • Validate assessment findings and engage system owners to ensure timely remediation. • Monitor cybersecurity advisories, threat intelligence notifications, and indicators of compromise (IOCs). • Perform IOC validation activities and coordinate blacklisting, containment, investigation, and remediation actions where necessary. • Track, monitor, and report remediation progress until closure. Security Operations & Incident Response • Investigate and follow up on security alerts, incidents, and suspicious activities escalated by the external SOC team across endpoints, servers, email, and cloud environments. • Assess security events, determine potential impact, gather relevant technical and business context, and coordinate containment, recovery, remediation, and closure activities. • Act as the internal coordination point between infrastructure teams, vendors, system owners, and external security providers during incident investigations. • Support security monitoring activities through SIEM dashboards, workbooks, queries, scheduled reporting, evidence collection, and case tracking. • Utilize approved AI-assisted tools to improve alert triage, investigation efficiency, log analysis, and case documentation in accordance with security and data-handling requirements. • Identify and promote practical AI-assisted use cases that improve operational consistency and security investigation effectiveness. Endpoint Security & Platform Protection • Administer and support endpoint protection and Endpoint Detection & Response (EDR) platforms. • Monitor agent health, policy compliance, signature updates, asset coverage, and endpoint security status. • Perform endpoint troubleshooting, agent deployment, reinstallation, and remediation activities. • Support housekeeping activities to maintain security tool effectiveness and infrastructure visibility. Security Awareness & User Engagement • Coordinate organisation-wide security awareness initiatives and phishing simulation campaigns. • Deliver targeted follow-up activities, awareness communications, and user education programs. • Monitor phishing resilience results and prepare reporting on participation rates, trends, and improvement opportunities. • Support broader cyber awareness initiatives including newsletters, learning modules, roadshows, and periodic security communications. Governance, Documentation & Reporting • Maintain and update security policies, procedures, standards, technical documents, operational playbooks, and tracking records. • Support review and maintenance of incident response procedures, investigation workflows, hardening standards, endpoint security procedures, and operational documentation. • Prepare monthly and ad-hoc cyber security reports, dashboards, inventories, metrics, and compliance-related documentation. • Maintain accurate operational records to support management reporting, regulatory compliance, audits, and continuous improvement activities. • Support multiple operational and project-based initiatives while meeting established timelines and service expectations. QUALIFICATIONS • Diploma or Degree in Information Technology, Cybersecurity, Computer Science,…