Cybersecurity Engineer

Fractional Role — Automation, AI Tooling & Hands-On Security Operations

Location Singapore / Kuala Lumpur, Malaysia (hybrid)

Employment Type Fractional / contract — concurrent multi-client engagements

Engagement Model 2–4 clients simultaneously; engagements run 3–4 weeks to 3 months per client

Experience 7+ years in cybersecurity; 2+ years hands-on automation

WHY THIS ROLE EXISTS

Security teams in Singapore and Malaysia are hiring at pace — approximately 245 genuine cyber roles were posted in Singapore alone in the last 30 days, and the Malaysia market mirrors that demand across banking, fintech, and regulated infrastructure. Most of these teams are still running manual playbooks: copy-paste SIEM queries, spreadsheet-driven risk registers, and penetration test reports assembled by hand. Many cannot justify or fill a full- time senior hire, but the gap in their security posture is real and growing.

This is a fractional role. You will work across two to four client organisations simultaneously, each with its own security stack, regulatory context, and maturity level. Engagements range from 3–4 week targeted sprints to 3-month programmes — you may be running a pentest at one client, building SOC automation at another, and closing out an AI governance engagement at a third, all in the same fortnight.

The work is hands-on: you build detection rules, run penetration tests, deploy automation, and ship AI-assisted tooling — then hand over cleanly and move to the next client.

WHAT YOU WILL DO

Security Operations & Detection Engineering

• Build, tune, and maintain detection rules across SIEM and EDR platforms (Splunk, Sentinel, CrowdStrike, or equivalent). Write detection-as-code, version-controlled and peer-reviewed — not point-and-click console rules.
• Automate alert triage using SOAR platforms (XSOAR, Shuffle, Tines, or custom Python). Target: reduce Tier-1

analyst manual triage by at least 40% within six months.

• Design and run tabletop exercises and purple-team sessions quarterly. Document findings, track remediation to closure.
• Integrate threat intelligence feeds into detection pipelines. Automate IOC enrichment, scoring, and blocking workflows. Penetration Testing & Offensive Security
• Conduct network, web application, and API penetration tests across on-premises and cloud environments (AWS, Azure, GCP).
• Automate recurring vulnerability scans and build dashboards that track remediation SLAs by asset owner — not just a list of CVEs dumped into a PDF.
• Script custom exploitation and post-exploitation tooling where off-the-shelf tools fall short. Python, Go, or Bash — whatever gets the job done.
• Write penetration test reports that technical teams can act on. Executive summaries that non-technical stakeholders can read without a translator. Cloud Security & DevSecOps
• Embed security checks into CI/CD pipelines: SAST, DAST, SCA, container scanning. If the pipeline does not break on a critical finding, fix the pipeline.
• Review and harden Infrastructure-as-Code (Terraform, CloudFormation) before deployment. Automate policy- as-code using OPA/Rego or equivalent.
• Monitor cloud posture using CSPM tooling (Prisma Cloud, Wiz, or Aqua). Automate drift detection and misconfiguration alerts. AI Tooling & Intelligent Automation
• Evaluate and deploy AI-assisted security tools for log analysis, anomaly detection, phishing classification, and code review. We expect you to test these tools against your own benchmarks before rolling them out — vendor demos are not evidence.
• Build LLM-powered workflows for common security tasks: automated report generation from scan outputs, natural-language querying of SIEM data, policy document summarisation. Use local or API-hosted models with appropriate data handling controls.
• Develop and maintain prompt libraries and evaluation harnesses for security-specific AI use cases. Track accuracy, false-positive rates, and analyst time saved.
• Contribute to the organisation's AI governance framework: model risk assessment templates, data classification for AI training inputs, and usage policies for generative AI in security operations.

Governance, Risk & Compliance (Supporting Role)

• Provide technical input for regulatory audits and compliance assessments under MAS TRM (Singapore), BNM RMiT (Malaysia), PDPA (both jurisdictions), and ISO 27001.
• Automate evidence collection for audit cycles — pull configurations, access reviews, and control states directly from systems rather than asking teams to fill spreadsheets.
• Maintain and update risk registers with real vulnerability and incident data, not theoretical risk ratings disconnected from operational reality.

WHAT YOU BRING

Non-Negotiable

• 7+ years in cybersecurity across at least two of: SOC/detection engineering, penetration testing, cloud security,

or DevSecOps. We will verify this with technical assessment, not just resume keywords.

• Production experience writing automation: Python scripting, API integrations, SOAR playbook development, or

CI/CD security pipeline configuration. Show us the code or the pipeline, not just the concept.

• Working knowledge of at least one major cloud platform (AWS, Azure, or GCP) at the security configuration level, not just user-level console access.
• Familiarity with Singapore and/or Malaysia regulatory frameworks for technology risk (MAS TRM, BNM RMiT).
• Hands-on experience with AI/ML tools applied to security: anomaly detection models, LLM-based automation,

or AI-driven threat hunting. We care about what you built and what it replaced, not which course you completed.

• Certifications in OSCP, GPEN, GCIH, CISSP, or AWS/Azure security specialty. These support your candidacy but do not substitute for demonstrated technical ability.
• Experience in financial services, fintech, or other regulated industries in Southeast Asia.
• Exposure to AI governance frameworks (NIST AI RMF, Singapore's Model AI Governance Framework, or ISO

42001). This area is early-stage — practical exposure matters more than deep expertise.

HOW WE MEASURE SUCCESS

Engagements range from 3–4 week sprints (a targeted pentest, a detection-rule audit, an automation build) to 3-

month programmes (SOC capability uplift, full cloud security posture review, AI governance framework rollout). The metrics below scale to the engagement length — a 3-week sprint has a tighter delivery window and a narrower scope than a 3-month programme, but the discipline is the same: agree the outcome upfront, deliver it, document what you leave behind.

Short Engagements (3–4 weeks)

• Day 1–3: Complete environment access, stakeholder introductions, and scope confirmation. Produce a one-page engagement plan with deliverables, owners, and deadlines before the first working week ends.
• Week 1–2: Execute primary deliverable — penetration test, detection rule audit, automation build, or vulnerability assessment. Preliminary findings shared verbally with the client CISO by the end of week 2 so there are no surprises in the final report.
• Week 3–4: Deliver final report or artefact. Include a handover document: what was done, what was not in scope, what the client team needs to maintain or monitor going forward. The engagement is not complete until the handover is accepted.
• Close-out: Client feedback collected within one week of delivery. One reusable artefact (template, playbook,

detection rule set, or script) contributed to the shared library from each short engagement.

Longer Engagements (2–3 months)

• Week 1–2 (Onboarding): Complete environment access, tool stack inventory, and stakeholder mapping. Deliver a written security posture snapshot — current detection coverage, automation gaps, and three prioritised quick wins — within the first 10 working days.
• Month 1: Deploy at least one automation workflow that measurably reduces manual effort. Target: 30–40%

reduction in a specific manual process (Tier-1 triage, evidence collection, scan-to-report cycle). The metric is agreed with the client CISO at onboarding.

• Month 2: Complete at least one penetration test or purple-team exercise. Deliver findings with remediation owners and SLA deadlines. Ship one AI-assisted tool or workflow into production use — track analyst hours saved or detection coverage gained, not adoption.
• Month 3: Deliver final engagement report with measurable before-and-after metrics. Conduct handover sessions with the client's internal team. Document all automation, detection rules, and AI workflows with enough detail that the client can maintain them independently.

Across the Portfolio (measured monthly by Engagement Lead)

• Client satisfaction: Post-engagement feedback scores and renewal or referral rate. If a client is dissatisfied, we want to know during the engagement, not after the final invoice.
• Utilisation: Maintain 80–90% billable allocation across concurrent clients. Below 80% is a pipeline problem;

above 90% typically means quality or context-switching is suffering. Flag either direction early.

• Throughput: With variable-length engagements, you will cycle through more clients per quarter than a fixed-

allocation model. Target: 4–6 completed engagements per quarter across the portfolio, depending on mix of short and long.

• Playbook reuse: Document repeatable artefacts that transfer across clients. Target: at least two reusable playbooks, detection rule sets, or assessment templates contributed to the shared library per quarter.
• Cross-client pattern recognition: Present a monthly internal brief — five slides, no padding — on common gaps,

misconfigurations, or regulatory blind spots you are seeing across engagements (sanitised, no client-attributable data).

• Scope discipline: Deliver within the contracted scope and hours. Scope creep absorbed silently erodes margins and sets expectations we cannot sustain. Flag overruns to the Engagement Lead within the week they occur, not at invoice time.