Security Exposure Engineer – 6 Months Contract

Position: Detection Engineer – Cybersecurity Employment Type: Contract Contract Duration: 6 months Work Location: Singapore Job Description We are seeking a hands-on cybersecurity professional with specialised experience across Security Exposure Management (SEM), External Attack Surface Management (EASM), Third-Party Cyber Risk/Assurance and Cyber Threat Intelligence (CTI) . The role will focus on continuously identifying external cyber exposures, assessing third-party security posture, validating material cyber threats and driving remediation across complex enterprise environments. Key Responsibilities • Perform continuous external attack-surface discovery and monitoring of internet-facing assets, domains, subdomains, IP addresses, certificates, exposed services and cloud resources. • Identify unknown, unmanaged and externally exposed assets and validate material security exposures. • Analyse vulnerabilities and external exposures against exploitability and threat intelligence to determine actual organisational risk. • Conduct end-to-end cybersecurity assessments of third-party service providers, including inherent risk assessment, security questionnaires, evidence review, control validation, risk rating and residual-risk assessment. • Perform cybersecurity due diligence and continuous assurance of critical third parties. • Assess fourth-party/nth-party dependencies and cyber-risk propagation across the supply chain. • Conduct structured third-party assessments using SIG, CAIQ, VDD/ODD or equivalent methodologies . • Assess security controls against NIST CSF, ISO 27001 and CIS Controls . • Investigate emerging vulnerabilities, active exploitation, external threats, leaked credentials, impersonation and digital-risk indicators. • Correlate threat intelligence, vulnerability information, asset criticality and external exposure to prioritise remediation. • Validate clear-and-present-danger cyber threats affecting the organisation or critical third parties. • Develop cyber exposure, third-party posture, risk dashboards and management reporting. • Automate security monitoring, enrichment, assessment and reporting activities using Python, PowerShell and/or Bash . • Work with security engineering, infrastructure, cloud, risk and business stakeholders to drive identified risks through remediation and closure. Essential Requirements • 3–5 years of hands-on cybersecurity experience with direct exposure to Security Exposure Management, EASM, Attack Surface Management or Digital Risk . • Hands-on experience conducting third-party/vendor cybersecurity assessments , beyond vendor coordination or procurement activities. • Experience conducting security questionnaires, evidence/control reviews, risk assessments and remediation tracking. • Practical understanding of third-party, fourth-party and nth-party cyber risk . • Experience with external attack-surface, cyber exposure, digital-risk or threat-intelligence platforms. • Strong vulnerability-management and risk-based prioritisation experience, including CVE, CVSS and actively exploited vulnerabilities . • Practical knowledge of NIST CSF, ISO 27001 and CIS Controls . • Strong understanding of TCP/IP, DNS, HTTP/HTTPS, TLS, APIs and internet-facing infrastructure . • Security exposure across AWS, Microsoft Azure and/or Google Cloud Platform . • Hands-on scripting/automation experience using Python, PowerShell and/or Bash . • Strong analytical, documentation, stakeholder-management and security-risk communication skills. Relevant Technology Exposure Hands-on experience with one or more of the following or equivalent technologies is highly desirable: SecurityScorecard, BitSight, RiskRecon, CyCognito, Censys, Microsoft Defender EASM, Tenable Attack Surface Management, Palo Alto Cortex Xpanse, Recorded Future, Flashpoint, Mandiant Threat Intelligence, ZeroFox, watchTowr, ServiceNow GRC/IRM and RSA Archer. Preferred Certifications • CompTIA Security+ / CySA+ • CEH • GIAC GSEC / GCIH • CISSP / Associate of ISC2 • CISM • ISO 27001 related certifications Candidates should have demonstrable hands-on experience in external cyber exposure and/or third-party cybersecurity assessment . Experience limited primarily to SOC alert monitoring, SIEM operations, general IT audit, vulnerability scanning or vendor coordination without direct cyber-risk assessment experience may not meet the specialised requirements of this position. Interested candidates are kindly requested to email their CV with their experience to sandeep.sringeripai@global.ntt We look forward to your application!