Security engineer

What does a security engineer do?

A security engineer designs, builds and runs the technical controls that protect an organisation's systems and data.

The work covers cloud platforms, networks, user access, servers and applications. The engineer also writes down how each control works and why it is there.

The role sits in the IT security or technology risk team. It often reports to a head of security or a chief information security officer. Banks regulated by the Monetary Authority of Singapore (MAS), government agencies, telcos, hospitals and technology firms all hire for it.

You work with cloud and infrastructure engineers, software developers, security analysts, auditors and risk teams. You turn their needs and the organisation's security rules into systems that run every day.

What the work involves

• Review new system designs and set the security controls they need, such as access rules, encryption and network separation.
• Build and roll out security tools, including logging, monitoring, identity and endpoint protection.
• Fix problems that appear when a new security system goes live, and tune it to cut false alarms.
• Write scripts and pipeline checks that automate repeated security work, such as scanning and access reviews.
• Help respond to incidents, then check and maintain security platforms and the documents that describe them.
• Run recovery drills and test exercises on existing systems to see whether controls and plans hold up.

Pay in Singapore

Back to top

Skills a security engineer needs

Back to top

Security engineer job description

We are hiring a security engineer to design, build and run security controls for our cloud and on-premises systems.

You will work with developers, infrastructure teams and risk staff to put secure designs into practice. You will also watch for threats and improve how we find and fix weaknesses.

Responsibilities

• Research current security architecture and network design practice, and recommend changes that suit the organisation.
• Design security controls that follow the organisation's security policies and industry standards.
• Implement and configure security systems such as SIEM, identity platforms, firewalls and cloud security tools.
• Run vulnerability scans, rank the findings by risk and track fixes with system owners.
• Add security checks to software build and release pipelines with the development teams.
• Write scripts to automate security tasks, such as access reviews, log collection and compliance checks.
• Support incident response by investigating alerts, containing problems and recording what happened.
• Keep security systems patched and healthy, and plan and run disaster recovery drills.
• Help meet obligations under the Personal Data Protection Act (PDPA) and any sector rules that apply.
• Write and maintain design records, standards and run books for security systems.

Requirements

• A diploma or degree in computer science, information technology, cybersecurity or a related field. Some employers accept equivalent hands-on experience.
• Typically 2 to 5 years in systems, network, cloud or security work for a mid-level post. Fresh graduates may start in analyst or junior engineer roles.
• Working knowledge of at least one major cloud platform, including its identity and logging services.
• Comfort with Linux and scripting, usually in Python or Bash.
• Experience with a SIEM such as Splunk and with vulnerability scanners.
• Industry certifications such as Security+, CISSP or a cloud vendor security certificate are often listed and sometimes required.

Back to top

Security engineer career path

Most security engineers start in analyst or junior engineering roles and move up through design and architecture work.

Senior paths lead to security leadership or specialist architecture roles.

1. Junior security engineer or cybersecurity analyst

   Entry

   You monitor alerts, run scans, follow run books and help with set-up of security tools under guidance.

2. Security engineer

   Mid · SkillsFuture title

   You design and implement security controls, fix problems in new systems and automate security processes.

3. Senior security engineer

   Senior · SkillsFuture title

   You lead larger designs, set security standards for projects, guide other engineers and handle complex incidents.

4. Security architect or lead security engineer

   Lead

   You set the security design for whole platforms or enterprises and plan security programmes across teams.

5. Head of security or chief information security officer

   Head

   You own the organisation's security strategy, budget and risk reporting to senior management.

Steps marked "SkillsFuture title" follow the career pathway in the SkillsFuture Skills Framework. The others are titles commonly used in Singapore.

Related jobs and their pay

Back to top

Security engineer interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. A team of developers needs access to your cloud accounts. How do you set up their permissions?

   What a good answer covers

   • Starts from least privilege and grants only the actions each role needs
   • Uses roles and groups instead of per-person permissions
   • Requires multi-factor authentication and short-lived credentials
   • Separates production from test accounts
   • Reviews access on a schedule and logs permission changes

2. You find a cloud storage bucket holding customer files open to the internet. What do you do, and how do you stop it happening again?

   What a good answer covers

   • Restricts access straight away and checks the access logs for outside reads
   • Finds out who owns the data and what it contains
   • Traces the cause, such as a template or a manual change
   • Adds preventive rules, such as account-level block settings and policy checks
   • Sets up automatic detection and alerts for similar mistakes

3. A scanner reports 2,000 findings across your servers. How do you decide what to fix first?

   What a good answer covers

   • Combines severity scores with exposure, such as internet-facing systems
   • Weighs whether a known exploit exists
   • Considers how important the system and its data are
   • Agrees fix deadlines with system owners and tracks them
   • Records accepted risks with an owner and a review date

4. How would you add security checks to a software build and release pipeline without slowing developers too much?

   What a good answer covers

   • Adds secret scanning, dependency checks and code analysis at suitable stages
   • Runs fast checks on every change and slower scans on a schedule
   • Sets clear rules for what blocks a release and what only warns
   • Gives developers findings in tools they already use
   • Measures false alarms and tunes the rules

5. Write the logic for a Splunk alert that catches a possible brute-force login attack. What would you check before you turn it on?

   What a good answer covers

   • Counts failed logins per account and per source over a time window
   • Flags a successful login that follows many failures
   • Excludes known scanners and service accounts
   • Tests the alert on past data to see how often it fires
   • Writes a short run book for whoever receives the alert

6. You are handed a new Linux server to put in production. How do you harden it?

   What a good answer covers

   • Removes unneeded packages and closes unused ports
   • Turns on a host firewall and restricts remote login to keys and approved sources
   • Applies updates and sets up a patch routine
   • Sets file permissions and sudo rules carefully
   • Sends system and authentication logs to central logging

7. How would you write a Python script to find cloud access keys that are old and unused? How would you make it safe to run?

   What a good answer covers

   • Uses the cloud provider's official library and read-only permissions
   • Lists keys, checks creation and last-used details, and reports the results
   • Handles errors and rate limits
   • Keeps secrets out of the code
   • Sends results to the key owners and logs what it did

8. Explain how you would separate a network so that a breach in one area does not spread to the rest.

   What a good answer covers

   • Divides the network into zones by function and sensitivity
   • Limits traffic between zones to what is needed
   • Places management access behind a controlled entry point
   • Monitors traffic between zones for odd behaviour
   • Tests the rules and keeps the network diagram current

9. You use an AI coding assistant such as Claude Code to help write security automation. How do you keep that safe and reliable?

   What a good answer covers

   • Never pastes secrets, customer data or private keys into prompts
   • Reads and tests all generated code before it runs
   • Runs it with limited permissions in a test setting first
   • Checks it follows the organisation's rules on using AI tools
   • Keeps code review and logging in place as for any other code

1. At 2am an alert shows a staff account logging in from two countries within minutes. What do you do?

   What a good answer covers

   • Confirms whether the logins are real and checks for impossible travel
   • Disables the session or forces a password reset and token revoke
   • Reviews what the account accessed and any changes it made
   • Escalates under the incident process and keeps a timeline
   • Looks for the cause, such as phishing, and fixes it

2. A serious flaw is announced in a software library used by dozens of your company's services. How do you respond?

   What a good answer covers

   • Builds an inventory of where the library is used
   • Ranks systems by exposure and data risk
   • Applies temporary protections, such as filtering rules, while fixes are prepared
   • Works with service owners on patches and tracks progress
   • Checks logs for signs of past attacks, then reviews how the inventory could be faster

3. You are asked to plan a disaster recovery drill for a key security system, such as your log platform. How do you set it up?

   What a good answer covers

   • Defines what failure the drill simulates and what success looks like
   • Confirms backups, recovery steps and who does what
   • Runs the drill in a safe window or test copy
   • Records the time taken and what went wrong
   • Updates the plan and run books after the drill

1. Describe a time a development team resisted a security control you proposed. What happened?

   What a good answer covers

   • Listens to the team's concern and understands the delivery pressure
   • Explains the risk in terms of the team's own goals
   • Offers a change that cuts the effort while keeping the protection
   • States the outcome and what changed in how you work with the team

2. Tell us about a time you had to explain a security risk to a manager who is not technical.

   What a good answer covers

   • Uses plain words and ties the risk to business impact
   • Gives the likely cause, the options and a recommendation
   • Is honest about what is unknown
   • Describes how the manager responded and the result

1. Customer personal data may have leaked from one of your systems. How do you handle it under the PDPA?

   What a good answer covers

   • Contains the problem and keeps evidence
   • Brings in the data protection officer and legal or compliance staff early
   • Assesses the harm and the number of people affected
   • Knows that some breaches must be reported to the Personal Data Protection Commission and to affected individuals within set timelines
   • Records the decisions, the cause and the fixes

Common questions about a security engineer job

Sources