Total 165 communications engineer job vacancies in Legal / Public / Security category

About Company

An international technology powerhouse that focuses on high-tech engineering and infrastructure protection. They design and deliver advanced safety and defense mechanisms for essential public and private utility frameworks.

About Job

• Architect Security Measures: Build and integrate protective frameworks tailored specifically for automated industrial control systems.

• Oversee Rollouts: Guide engineering squads and coordinate closely with clients throughout the entire project lifecycle to ensure defense standards are met.

• Neutralize Vulnerabilities: Formulate proactive remediation strategies and upgrade network architectures to minimize operational downtime and risks.

• Investigate Anomalies: Provide deep technical analysis during active security breaches and lead subsequent post-mortem forensic evaluations.

• Monitor Landscape: Keep track of the evolving global threat matrix and regulatory changes to continually upgrade existing protection models.

Requirements

• Domain Track Record: At least 6 years of professional experience navigating the intersection of corporate IT and industrial operational technology networks.

• Supervisory Background: Demonstrated history of managing engineering personnel and leading multi-tiered deployment initiatives.

• Core Systems Literacy: Comprehensive grasp of automated industrial environments, including centralized control systems and programmable logic units.

• Defense Toolkits: Deep familiarity with perimeter defense, endpoint protection, user access management, and traffic monitoring tools.

• Compliance & Frameworks: Sound understanding of international cybersecurity benchmarks, compliance audits, and architectural blueprints.

• Interpersonal Skills: Exceptional analytical capabilities paired with the ability to translate technical jargon for non-technical business units.
  

  To apply online please use the 'apply' function, alternatively you may contact Evangeline. (EA: 94C3609/ R24124002)

Required Skills & Qualifications

• Strong hands-on experience with:
• IBM Watsonx (Watsonx.ai, Watsonx.data, Watsonx Orchestrate)
• QRadar SIEM
• IBM Resilient SOAR
• Experience in:
• AI/ML integration or LLM-based applications
• Prompt engineering and automation workflows
• Proficiency in:
• Python / APIs / automation frameworks
• Strong understanding of:

• SOC operations (incident response, threat analysis)

  • Fully functional and optimized AI-driven automation agents
  • Integration with QRadar and Resilient platforms
  • Documentation of workflows and configurations
  • Production deployment support and knowledge transfer

This position is being recruited to support regional information security operations and strengthen cybersecurity capabilities across overseas regions.

Responsibilities:

·      Support the implementation and operation of information security controls and solutions across overseas regions, covering areas such as infrastructure, network, endpoint, application, data, and identity security.

·      Participate in security projects and initiatives, including planning, coordination, deployment, and ongoing improvement activities.

·      Assist in the implementation of governance, risk, compliance, privacy, and data protection initiatives.

·      Support the development and maintenance of security standards, procedures, and technical baselines.

·      Collaborate with regional and global teams to improve overall cybersecurity capabilities.

·      Provide ad-hoc support for regional and global cybersecurity initiatives as required.

Requirements:

·      Bachelor’s degree in information security, Cyber Security, Computer Science, Information Technology, or a related field.

·      At least 2 years of working experience in information security, cybersecurity, network security, IT infrastructure, system administration, or related areas.

·      Familiar with common information security technologies and concepts, such as network security, endpoint security, IAM, data protection, vulnerability management, SOC/SIEM, or cloud security.

·      Familiar with information security and privacy frameworks, such as ISO 27001/27701, ITIL, or related standards and best practices.

·      Basic knowledge of networking and operating systems (Windows/Linux).

·      Good analytical, problem-solving, and communication skills.

·      Able to work effectively with teams across different regions and cultures.

·      Security certifications (e.g. CISSP, CISA, CCSP, Security+, CCNA/CCNP) are an advantage.

·      Candidates with a Diploma and strong relevant working experience will also be considered.

·      Excellent communication and interpersonal skills in both English and Chinese (to liaise with Mandarin speaking stakeholders).

A Security Engineer I is professional responsible for designing, implementing, and maintaining technical security measures, focusing on vulnerability management, threat detection, and infrastructure protection. They secure cloud/on-prem environments using automation (Python, Terraform) and tools like SIEM or EDR, often collaborating with DevOps to remediate security risks and strengthen security posture.

Essential Functions:

• Develop and maintain security policies, guidelines, and lead implementation in all systems, including AWS and in particular CloudTrail, EKS, AWS Inspector, EC2, EMR, S3, AWS Identity Center, RDS, Security Hub, Guard Duty.

• Architect, design, implement, support, and evaluate security-focused tools and controls to meet security and compliance needs.

•  Integrate security checks into the CI/CD pipelines to ensure continuous compliance and shift left security practice.

• Utilize tools like Terraform or Cloud Formation to build, deploy and enforce compliance and secure cloud infrastructure.

• Utilize networking (VPC, Firewall, Transit Gateways), container security and encryption.

• Builds scripts (phyton, bash) and serverless functions (AWS Lambda) for alerting on anomalies, misconfigurations and threats include automations to auto respond to such threat actors/findings.

• Oversee threat management and security incident handling, including the coordination of investigations and reporting of security incidents to management, in alignment with business.

•  Work with the team and QSA on PCI (level 1 & level 2 service provider) & SOC initiatives for the company.

• Ensure that security is factored into the evaluation, selection, and configuration of hardware, applications and software.

• Ensure audit trails, systems logs and other monitoring data sources are reviewed periodically and are in compliance with policies and audit requirements. Provide support and guidance for legal and regulatory compliance efforts, including audit support.

• Promote information security awareness throughout the company. Stay current with security technologies and threats by monitoring vendor and industry publications and attending training.

• Secure sensitive data, manage user credentials through principal of least privileges, track user activity.

• Proactively identify security risks and implement practices that meet standards for information security, by analyzing current systems, and working with IT and the business. Partner with development and infrastructure teams to identify and remediate vulnerabilities Develop mitigation plans.

Qualifications:

• Bachelor Degree in Computer Science or related technical field

• 3 to 5 years in cybersecurity experience within a professional environment

• Certified Information Systems Security Professional certification is a plus

Knowledge, Skills and Abilities:

• Experience with IDS/IPS, file integrity, internal/ external penetration & vulnerability tests, FIM, SEIM, Log aggregation tools required

• Development and scripting experience to build automation: Lambda, Terraform, Cloud Formation, API Integrations

• Understanding of the software development life cycle and CI/CD pipelines

• Ability to execute process and standards around code quality and the deployment lifecycle including SAST and DAST

• Experience in SIEM, MDR, EDR, DLP Identity Management, WAF, WAS, Incident Response, attack surface management

• Proactively find weaknesses in applications and network through audits, penetration tests and security assessments

• Prepare reports on security metrics, attempted attacks, document findings and actions taken

• Proven record of learning new languages, skills and technologies quickly, with minimal guidance

• Takes initiative, stays focused, always accountable

• Thrives in a fast-paced environment with the ability to focus on achieving the target whole minding longer term goals along the way

• Excellent communication skills

To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed above are representative of the knowledge, skill, and/ or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

• Assist in the planning, deployment, and enhancement of cybersecurity products and solutions across client environments.
• Support the implementation, configuration, and upgrade of security platforms, ensuring optimal performance and compliance with security best practices.
• Provide technical guidance and support to both internal teams and external clients on the effective use of the company’s cybersecurity solutions.
• Conduct product training sessions and knowledge sharing for clients and internal stakeholders to ensure proper usage and adoption.

Requirements:

• Diploma in IT or equivalent
• At least 2 years of hands-on experience with CyberArk within the IT, Information Security, or Cybersecurity industry.
• Strong technical troubleshooting and problem-solving skills.
• Ability to work independently as well as collaboratively in a team environment.

If you are keen to apply for the position, kindly email your detailed resume in MS Word to hr@recruit-expert.com

Please note that only shortlisted candidates will be notified.

For more job opportunities, please visit our website at www.recruit-expert.com

EA Licence: 19C9701

Registration: R1326740

• Assist in the planning, deployment, and enhancement of cybersecurity products and solutions across client environments.
• Support the implementation, configuration, and upgrade of security platforms, ensuring optimal performance and compliance with security best practices.
• Provide technical guidance and support to both internal teams and external clients on the effective use of the company’s cybersecurity solutions.
• Conduct product training sessions and knowledge sharing for clients and internal stakeholders to ensure proper usage and adoption.

Requirements:

• Diploma in IT or equivalent
• At least 2 years of hands-on experience with CyberArk within the IT, Information Security, or Cybersecurity industry.
• Strong technical troubleshooting and problem-solving skills.
• Ability to work independently as well as collaboratively in a team environment.

If you are keen to apply for the position, kindly email your detailed resume in MS Word to hr@recruit-expert.com

Please note that only shortlisted candidates will be notified.

For more job opportunities, please visit our website at www.recruit-expert.com

EA Licence: 19C9701

Registration: R1326740

about company

I am currently working with a software consultancy firm that provides premium software development and strategy expertise to a wide spectrum of clients. Projects related to Gaming/Gambling/Blockchain.

Base + AWS + variable bonus. Hybrid working, Friday WFH. Office at CBD.

about job (1 opening for Cloud Security Engineer, 1 opening for Lead level)

• Protects system by defining access privileges, control structures, and resources.

• Safeguards information system assets by identifying and solving potential and actual security problems.

• Recognizes problems by identifying abnormalities; reporting violations.

• Determines security violations and inefficiencies by conducting periodic audits.

• Consolidate root cause analysis of past pentest results.

• Upgrades system by implementing and maintaining security controls.

skills and requirements

• Min 3 years experience in AWS Cloud Security, Security Hub, Guard Duty, Inspector, etc.

• Strong understanding of SSDLC and security frameworks.

• Knowledge in OWASP Security Standards.

• In-depth knowledge of architecture, engineering, and operations of at least one enterprise IDS/IPS/SIEM platform.

• Hands on experience with vulnerability scanning and pentesting tools.

• Hands-on experience analyzing high volumes of logs, network data (e.g. Netflow, FPC), and other attack artifacts in support of incident investigations.

• Experience with IAM architectures and solutions including AD, RBAC, SSO, identity lifecycle management

• Mandarin speaking required as you need to liaise with Chinese counterparts who can only speak and write in Mandarin

To apply online please use the 'apply' function, alternatively you may contact Stella at 96554170 (EA: 94C3609 /R1875382)

Description

IAM Operations

• Manage the day-to-day operations of IAM systems, including provisioning, de-provisioning, and lifecycle management of user and machine identities.
• Administer and maintain Active Directory and LDAP directory services, ensuring accurate and up-to-date identity records across the environment.
• Operate and support One Identity solutions, handling configuration, troubleshooting, and routine maintenance.
• Process access requests in a timely manner, ensuring requests are fulfilled in accordance with established policies and approval workflows.
• Monitor IAM systems for anomalies, policy violations, and potential security threats, escalating and resolving issues promptly.
• Maintain accurate documentation of IAM configurations, procedures, access records, and operational runbooks.

Access Governance and Compliance

• Support periodic access reviews and IAM audits, identifying and remediating access risks in line with internal policies and regulatory requirements.
• Assist in tracking IAM-related risks and remediation action plans, providing updates to relevant stakeholders.
• Generate reports on access activity, identity lifecycle status, and compliance posture for management and audit purposes.

Stakeholder Support

• Serve as the first point of contact for IAM-related issues and queries from users and IT teams, providing clear and timely resolution.
• Work closely with the broader IT and security teams to ensure identity and access controls remain aligned with business needs.
• Maintain service quality and operational consistency as the team transitions project-focused members to new IAM initiatives.

Description

IAM Operations

• Manage the day-to-day operations of IAM systems, including provisioning, de-provisioning, and lifecycle management of user and machine identities.
• Administer and maintain Active Directory and LDAP directory services, ensuring accurate and up-to-date identity records across the environment.
• Operate and support One Identity solutions, handling configuration, troubleshooting, and routine maintenance.
• Process access requests in a timely manner, ensuring requests are fulfilled in accordance with established policies and approval workflows.
• Monitor IAM systems for anomalies, policy violations, and potential security threats, escalating and resolving issues promptly.
• Maintain accurate documentation of IAM configurations, procedures, access records, and operational runbooks.

Access Governance and Compliance

• Support periodic access reviews and IAM audits, identifying and remediating access risks in line with internal policies and regulatory requirements.
• Assist in tracking IAM-related risks and remediation action plans, providing updates to relevant stakeholders.
• Generate reports on access activity, identity lifecycle status, and compliance posture for management and audit purposes.

Stakeholder Support

• Serve as the first point of contact for IAM-related issues and queries from users and IT teams, providing clear and timely resolution.
• Work closely with the broader IT and security teams to ensure identity and access controls remain aligned with business needs.
• Maintain service quality and operational consistency as the team transitions project-focused members to new IAM initiatives.

JD for System Engineer

Manage the day-to-day operations of client systems, including provisioning, de-provisioning, and lifecycle management of user and machine identities. Administer and maintain Active Directory and LDAP directory services, ensuring accurate and up-to-date identity records across the environment. Operate and support One Identity solutions, handling configuration, troubleshooting, and routine maintenance. Process access requests in a timely manner, ensuring requests are fulfilled in accordance with established policies and approval workflows. Monitor client systems for anomalies, policy violations, and potential security threats, escalating and resolving issues promptly. Maintain accurate documentation of system configurations, procedures, access records, and operational runbooks.

Access Governance and Compliance

Support periodic access reviews and audits, identifying and remediating access risks in line with internal policies and regulatory requirements. Assist in tracking system related risks and remediation action plans, providing updates to relevant stakeholders. Generate reports on access activity, identity lifecycle status, and compliance posture for management and audit purposes.

Stakeholder Support

Serve as the first point of contact for system -related issues and queries from users and IT teams, providing clear and timely resolution. Work closely with the broader IT and security teams to ensure identity and access controls remain aligned with business needs. Maintain service quality and operational consistency as the team transitions project-focused members to new system initiatives.

The IAM Operations Analyst is responsible for the day-to-day operation, administration, and support of the organization's Identity and Access Management (IAM) services. This role ensures that user and machine identities are managed securely and efficiently throughout their lifecycle while maintaining compliance with internal policies and regulatory requirements. The position works closely with IT, security, and business stakeholders to deliver reliable identity services, support access governance activities, and maintain a strong security posture across the enterprise.

Key Responsibilities

IAM Operations

• Manage the daily operation of IAM platforms, including user and machine identity provisioning, de-provisioning, modification, and lifecycle management.
• Administer and maintain Active Directory (AD) and LDAP directory services, ensuring the accuracy and integrity of identity data across the environment.
• Operate, support, and maintain One Identity solutions, including configuration, troubleshooting, issue resolution, and routine system maintenance.
• Process access requests in accordance with established policies, approval workflows, and service level expectations.
• Monitor IAM systems and services for operational issues, anomalies, policy violations, and potential security threats, escalating and resolving incidents as required.
• Maintain and update IAM documentation, including system configurations, operational procedures, access records, and support runbooks.
• Support system upgrades, patches, and ongoing improvements to IAM platforms and processes.

Access Governance & Compliance

• Support periodic access certification reviews and audit activities to ensure appropriate access rights are maintained across the organization.
• Identify, investigate, and remediate access-related risks and control gaps in alignment with internal policies and regulatory requirements.
• Assist in tracking IAM-related risks, remediation activities, and action plans, providing regular updates to stakeholders.
• Generate and maintain reports on user access, identity lifecycle activities, policy compliance, and audit findings.
• Support evidence collection and documentation for internal and external audits.

Stakeholder Support & Service Delivery

• Act as the primary point of contact for IAM-related requests, incidents, and inquiries from users, application owners, and IT teams.
• Provide timely troubleshooting and resolution of IAM issues while maintaining a high level of customer service.
• Collaborate with IT infrastructure, cybersecurity, and application teams to ensure identity and access controls align with business and security requirements.
• Contribute to continuous service improvement initiatives, helping maintain operational stability while supporting ongoing IAM transformation projects.
• Ensure service quality, operational consistency, and knowledge transfer as resources transition between operational and project-based IAM initiatives.

Qualifications & Experience

Required

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
• Experience supporting Identity and Access Management operations in an enterprise environment.
• Hands-on experience with Active Directory, LDAP, and identity lifecycle management processes.
• Experience administering or supporting One Identity solutions or comparable IAM platforms.
• Understanding of access governance, role-based access control (RBAC), joiner-mover-leaver processes, and privileged access concepts.
• Knowledge of IT security principles, audit requirements, and compliance frameworks.
• Strong troubleshooting, analytical, and problem-solving skills.
• Excellent communication and stakeholder management abilities.

Preferred

• Experience with identity governance and administration (IGA) platforms.
• Familiarity with cloud identity services such as Microsoft Entra ID (Azure AD) or other cloud IAM technologies.
• Knowledge of ITIL service management practices.
• Relevant certifications such as Security+, ITIL Foundation, Microsoft Identity certifications, or IAM-related certifications.

The IAM Operations Analyst is responsible for the day-to-day operation, administration, and support of the organization's Identity and Access Management (IAM) services. This role ensures that user and machine identities are managed securely and efficiently throughout their lifecycle while maintaining compliance with internal policies and regulatory requirements. The position works closely with IT, security, and business stakeholders to deliver reliable identity services, support access governance activities, and maintain a strong security posture across the enterprise.

Key Responsibilities

IAM Operations

• Manage the daily operation of IAM platforms, including user and machine identity provisioning, de-provisioning, modification, and lifecycle management.
• Administer and maintain Active Directory (AD) and LDAP directory services, ensuring the accuracy and integrity of identity data across the environment.
• Operate, support, and maintain One Identity solutions, including configuration, troubleshooting, issue resolution, and routine system maintenance.
• Process access requests in accordance with established policies, approval workflows, and service level expectations.
• Monitor IAM systems and services for operational issues, anomalies, policy violations, and potential security threats, escalating and resolving incidents as required.
• Maintain and update IAM documentation, including system configurations, operational procedures, access records, and support runbooks.
• Support system upgrades, patches, and ongoing improvements to IAM platforms and processes.

Access Governance & Compliance

• Support periodic access certification reviews and audit activities to ensure appropriate access rights are maintained across the organization.
• Identify, investigate, and remediate access-related risks and control gaps in alignment with internal policies and regulatory requirements.
• Assist in tracking IAM-related risks, remediation activities, and action plans, providing regular updates to stakeholders.
• Generate and maintain reports on user access, identity lifecycle activities, policy compliance, and audit findings.
• Support evidence collection and documentation for internal and external audits.

Stakeholder Support & Service Delivery

• Act as the primary point of contact for IAM-related requests, incidents, and inquiries from users, application owners, and IT teams.
• Provide timely troubleshooting and resolution of IAM issues while maintaining a high level of customer service.
• Collaborate with IT infrastructure, cybersecurity, and application teams to ensure identity and access controls align with business and security requirements.
• Contribute to continuous service improvement initiatives, helping maintain operational stability while supporting ongoing IAM transformation projects.
• Ensure service quality, operational consistency, and knowledge transfer as resources transition between operational and project-based IAM initiatives.

Qualifications & Experience

Required

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
• Experience supporting Identity and Access Management operations in an enterprise environment.
• Hands-on experience with Active Directory, LDAP, and identity lifecycle management processes.
• Experience administering or supporting One Identity solutions or comparable IAM platforms.
• Understanding of access governance, role-based access control (RBAC), joiner-mover-leaver processes, and privileged access concepts.
• Knowledge of IT security principles, audit requirements, and compliance frameworks.
• Strong troubleshooting, analytical, and problem-solving skills.
• Excellent communication and stakeholder management abilities.

Preferred

• Experience with identity governance and administration (IGA) platforms.
• Familiarity with cloud identity services such as Microsoft Entra ID (Azure AD) or other cloud IAM technologies.
• Knowledge of ITIL service management practices.
• Relevant certifications such as Security+, ITIL Foundation, Microsoft Identity certifications, or IAM-related certifications.

Cyber Security Operations Engineer

What You’ll Do:

Person to perform/maintain the following:

• Network security management (e.g. intrusion prevention system, virtual private network)
• Web security management (e.g. URL filtering, web application firewall)
• End point security management (e.g. anti-malware, device control, application control, data loss prevention or network access control)
• Messaging security management (e.g. anti-malware, anti-spam, content filtering)
• Security & vulnerability management (security information and event management, security device systems management, device and application vulnerability management)
• Automation of management tasks

What You’ll Need:

• Degree in Computer-related disciplines
• At least 5 years of experience that covers management of enterprise security solution
• Experience in implementation and integration of Cyber Security Platform
• Possess knowledge across various information security technologies/areas in a large enterprise including firewalls, intrusion detection, encryption, Linux O/S, Windows O/S, databases, antivirus, patch management, vulnerability scanning, backup, logging and monitoring, remote access, application development, network security, application security, and change management
• Information Security or IT Controls Certification such as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM) would be an added advantage

If the above role is a good fit for you, or if you know anyone whomight be good for the role, please get in touch with an updated CV and I'll bein touch!

EA Reg Number: R1660446

EA License Number: 07C3924 

Company Registration No: 200609504D

About the Role:

We are seeking a hands-on Cyber Security Firewall Engineer to provide operational support and security platforms. The ideal candidate will be experienced in managing Fortinet FortiGate and Palo Alto Networks firewalls, with foundation in network security, policy management, and incident response.

Key Responsibilities:

Firewall Operations (Fortinet & Palo Alto)

• Manage firewall rules creation, change requests, rule optimization, NAT/VPN configuration and firmware upgrades.

• Monitor traffic, identify anomalies, and remediate security events.

• Maintain HA configurations, routing and logging integrations.

• Support audits and evidence collection for regulatory/compliance requirements.

Tripwire

• Administer policies, baselines, agents, alerts, and remediation workflows.

• Investigate integrity violations; tune rules to reduce false positives.

Imperva (DB Security/DAM)

• Configure security policies, signatures, profiles, and exceptions.

• Monitor application-layer attacks; tune rules to balance protection and usability.

• Support database activity monitoring policies and reporting where applicable.

• Security Monitoring & Incident Response

• Triage alerts conduct root-cause analysis, and coordinate remediation.

Required Qualifications:

Hands-on expertise with:

• Fortinet FortiGate (policies, VPN, routing, HA, SD-WAN, logging).

• Palo Alto Networks firewalls (policies, NAT, App-ID, User-ID, Panorama).

• Tripwire (Hice to Have).

• Imperva (Hice to Have).

• Strong understanding of networking fundamentals (TCP/IP, VLANs, routing, NAT, SSL/TLS, DNS ).

• Experience in incident response, change management, and documentation.

• Ability to work independently with a focus on accuracy, speed, and risk reduction.

Preferred Certifications (Nice to Have)

Fortinet NSE 4–7, Palo Alto PCNSA/PCNSE, Imperva Certified Professional.

Soft Skills

• Clear communication with stakeholders and change advisory boards.

• Structured problem-solving and risk-based decision-making.

• Ownership mindset with strong time management for a contract environment.

Deliverables & KPIs

• Firewall rules changes are accordance to requests.

• Successful completion of firmware upgrades and config backups with rollback plans.

• Updated Tickets, network diagrams, and change records.

• Handover documentation and knowledge transfer at contract end.

Tools & Environment

• FortiGate / FortiManager / FortiAnalyzer

• Palo Alto NGFW / Panorama

• Tripwire Enter

Working hours :

8:30am to 6pm (Monday to Friday) onsite, no hybrid option.

Job Title: Microsoft Purview DLP Security Analyst / M365 DLP Support Engineer

Employment Period: August/September 2026 to March 2027, with possible yearly renewal
Location: 1 Fusionopolis Way
Working Hours: Monday to Friday, 8:30am to 6:00pm
Engagement Type: Contract / Renewable Term

Role Overview
We are seeking a Microsoft Purview DLP Security Analyst / M365 DLP Support Engineer to support Data Loss Prevention alert monitoring, incident handling, investigation, reporting, user support, and policy improvement activities.

The successful candidate will work closely with security operations, service desk, data owners, business users, compliance teams, and Microsoft Purview SMEs to ensure DLP alerts are properly monitored, investigated, classified, documented, escalated, and improved through continuous policy tuning.

Key Responsibilities

DLP Alert Monitoring & Incident Handling
Monitor DLP alerts from Microsoft Purview DLP Dashboard, Microsoft Defender XDR, email notifications, service desk tickets, and related alerting channels.

Log, track, triage, and classify DLP alerts, including initial investigation of true positives and false positives.

Perform first-level analysis and escalate high-risk or complex incidents to L2 security operations, L3 Purview SMEs, architects, compliance, legal, or other relevant stakeholders where required.

Investigation & Analysis
Perform detailed analysis of DLP incidents to identify root causes, including user behaviour, policy gaps, data misclassification, or process issues.

Validate and document false positives clearly to support policy improvement and operational reporting.

Support forensic analysis and evidence gathering for high-risk DLP incidents where required.

Escalation & Stakeholder Coordination
Coordinate with SOC teams, service desk, business units, data owners, compliance, legal, and IT stakeholders to ensure DLP incidents are handled appropriately and within expected timelines.

Communicate DLP-related issues clearly to both technical and non-technical users.

Policy Tuning & Change Management
Work with L3 SMEs and architects to recommend improvements to DLP policies based on repeated alerts, user feedback, threat trends, false positive patterns, and post-incident findings.

Support DLP change management activities arising from new regulatory requirements, new workloads such as Teams, Copilot or SaaS applications, and post-incident improvements.

Provide practical recommendations to improve DLP policy effectiveness and reduce unnecessary business disruption.

User Support & Awareness
Respond to user-reported DLP issues, including blocked activities, policy alerts, and suspected false positives.

Provide guidance to users on compliant data handling and proper use of sensitive information.

Support communication and awareness activities related to DLP policy enforcement.

Monitor and ensure the AI agent is running and responding correctly where applicable.

Reporting & Continuous Improvement
Prepare periodic DLP reports covering alert volumes, top users triggering policies, false positive rates, policy effectiveness trends, recurring issues, and recommended improvements.

Maintain proper documentation of investigations, findings, escalations, and closure actions.

Technical Skills Required
Strong hands-on knowledge of Microsoft Purview DLP is mandatory.

Experience in Microsoft Purview policy configuration, troubleshooting, alert review, and operational support.

Good understanding of DLP across Endpoint, Exchange, SharePoint, Teams, and Microsoft 365 workloads.

Knowledge of Microsoft Defender XDR, Microsoft 365 Compliance Portal, Microsoft Entra, sensitivity labels, data classification, and information protection.

Microsoft Intune experience will be an added advantage.

Operational & SOC Skills
Experience in incident triage, investigation, security alert analysis, ticket handling, true/false positive determination, and basic log analysis.

Experience with ticketing tools such as ServiceNow or similar platforms.

Ability to work with SOC, service desk, compliance, legal, and business stakeholders.

Data Security & Compliance Knowledge
Good understanding of data protection, data classification, data exfiltration risks, insider risk awareness, and DLP control concepts.

Knowledge of Singapore PDPA and data protection practices will be advantageous.

Soft Skills
Strong communication skills with business users and technical stakeholders.

Ability to explain DLP blocks, alerts, and policy enforcement in a professional and user-friendly manner.

Strong analytical thinking, root-cause analysis, documentation, and coordination skills.

Able to work independently while escalating appropriately when needed.

Experience Requirement
3 to 5 years of experience in Microsoft 365, Microsoft Purview, DLP, security operations, end-user support, or L2 support.

Hands-on experience supporting Microsoft Purview DLP in an enterprise environment is strongly preferred.

Preferred Certifications
Microsoft SC-400: Information Protection Administrator
Microsoft SC-200: Security Operations Analyst
Microsoft MS-102: Microsoft 365 Administrator
Microsoft SC-300: Identity and Access Administrator