Principal Security Engineer - SIRT (Singapore)

Location: Singapore Office; hybrid working mode. Work is primarily office-based, with some datacenter or lab activities that may involve lifting equipment weighing up to 50 lbs. Participation in an on-call rotation is required, including occasional early morning, evening, overnight, weekend, and holiday work. Travel may be required up to approximately 20%; a current passport is required.

Company

hirify.global develops and secures applications and digital services, with a focus on cybersecurity and protecting customers, products, and services.

What you will do

• Deliver Tier 2 and Tier 3 security support, prioritize complex customer issues, and engage escalation teams.
• Lead security incident investigations, attack analysis, mitigation, post-mortems, and root-cause improvement activities.
• Monitor, validate, assess, and prioritize vulnerabilities affecting products and services, coordinating remediation with Engineering and other stakeholders.
• Develop and publish security advisories, mitigations, fix notifications, incident response plans, QSN playbooks, and vulnerability management workflows.
• Collaborate with external security researchers and organizations including CISA, FIRST, VINCE, and other PSIRTs.
• Serve as a technical lead and mentor, deliver training and attack simulations, document reusable security knowledge, and provide operational metrics and executive-level reporting.

Requirements

• At least 15 years of experience in technical security roles, such as incident response, security support, monitoring, or consulting.
• Bachelor’s degree or equivalent practical experience.
• Information security subject matter expertise, including extensive experience managing incidents in production environments and coordinating product vulnerability response.
• Expert understanding of CVE, CPE, CVSS, vulnerability assessment, risk prioritization, security frameworks, and NIST standards.
• CISSP, GCIH, or comparable demonstrated skills, with the ability to obtain certification; public cloud certification or equivalent demonstrated capability is expected.
• Expert knowledge of application, network, and infrastructure security, including threat modeling, secure architecture, secure coding, and security testing.
• Extensive experience analyzing and mitigating DDoS, web application, DNS, and other network attacks, plus knowledge of malware and common infection vectors.
• Strong hands-on networking expertise covering TCP/IP, TLS/SSL, DNS, HTTP, LAN/WAN environments, packet analysis, and common network architectures.
• Expert experience with WAFs, firewalls, IDS/IPS, vulnerability scanners, operating system hardening, load balancers, and security monitoring tools.
• Proficiency in Python and additional scripting languages; working knowledge of UNIX/Linux tools; ability to analyze code-level vulnerabilities and develop attack proofs of concept.
• Hands-on experience with AWS, Azure, or GCP, and technologies including Docker, Kubernetes, Terraform, and Ansible.
• Knowledge of microservices, modern application architectures, and API security.
• Strong analytical, organizational, and leadership skills, with the ability to manage competing priorities independently and collaborate across global teams.
• Fluent written and spoken English, including the ability to explain technical risks to customers, engineers, and executives and create effective training content.
• Experience with incident tracking systems.
• Support for regional operations across the Americas, EMEA, and APJ.
• Required participation in on-call rotations and occasional work outside core business hours.

Nice to have

• Multiple security certifications.
• Siebel experience.

Culture & Benefits

• Hybrid working mode with career growth and development opportunities.
• Employee Assistance Program.
• Competitive pay and comprehensive benefits.
• Diversity and Inclusion Interest Groups.
• Security-focused culture with research, training, knowledge sharing, and continuous improvement.