The Security Engineer is part of the Infrastructure team at Xtremax, responsible for protecting the organization's systems, infrastructure, and customer data against security threats and vulnerabilities. The role focuses on implementing and maintaining security solutions, identifying and mitigating potential risks, and ensuring the security and reliability of Xtremax's IT environment as the business continues to grow.

The ideal candidate has hands-on experience in infrastructure security, system hardening, vulnerability assessment, security monitoring, and incident response. This role requires strong analytical and problem-solving skills, the ability to work independently and collaboratively, and a proactive approach to identifying security risks and implementing effective solutions.

Responsibilities

• Infrastructure Security: Implement, configure, and maintain security controls across IT infrastructure, including servers, operating systems, networks, endpoints, and other systems.
• Vulnerability Management: Conduct regular vulnerability assessments, security scans, and penetration testing to identify security weaknesses and recommend appropriate remediation measures.
• System Hardening and Patch Management: Perform system hardening, security configuration reviews, and patch management to strengthen infrastructure security and reduce vulnerabilities.
• Security Monitoring and Incident Response: Monitor potential security threats, investigate suspicious activities, respond to security incidents, and implement preventive measures to minimize security risks.
• Security Solutions Management: Manage and maintain security tools and solutions, including antivirus, endpoint protection, and malware prevention technologies.
• Data Protection and Recovery: Implement and maintain data protection, backup, and recovery procedures to safeguard critical information and support business continuity.
• Security Policies and Controls: Develop, implement, and maintain security policies, standards, and technical controls aligned with industry best practices and applicable regulatory requirements.
• Security Assessment and Auditing: Conduct periodic internal security assessments and reviews to evaluate the effectiveness of security controls, identify gaps, and recommend improvements.
• Security Documentation: Maintain technical documentation for security configurations, patching activities, access controls, vulnerability assessments, penetration testing, incident handling, and backup and recovery procedures.
• Cloud Security: Implement and maintain security controls for cloud infrastructure and services, ensuring appropriate access management, configuration, and protection of cloud-based resources.
• Security Collaboration: Work closely with infrastructure, development, and other technical teams to integrate security best practices into system design, deployment, and maintenance.
• Security Awareness: Promote information security awareness by educating employees on security best practices, potential threats, and preventive measures.
• Continuous Improvement: Stay up to date with emerging security threats, vulnerabilities, technologies, and industry best practices to continuously improve the organization's security posture.

Requirements

• Bachelor's degree in Software Engineering, Computer Science, Information Technology, or a related field, or equivalent practical work experience.
• Good understanding of information security principles, security systems, and security policies.
• Experience handling sensitive and confidential data and implementing appropriate security measures.
• Familiarity with workstation and endpoint security, system patching, upgrades, and maintenance of applications, services, and infrastructure components.
• Understanding of planning, developing, implementing, and maintaining effective IT security controls.
• Familiarity with system hardening, vulnerability assessment, and penetration testing.
• Experience managing antivirus, endpoint security, and malware protection solutions.
• Familiarity with information security frameworks, particularly ISO 27001.
• Familiarity with Linux and Windows operating systems and their security configurations.
• Understanding of cloud security services and concepts across platforms such as AWS, Microsoft Azure, and Google Cloud Platform (GCP).
• Basic scripting skills in languages such as Bash or Python for security automation and operational tasks.
• Strong analytical, troubleshooting, and problem-solving skills.
• Willingness to learn, evaluate, and adopt new technologies to improve security practices.
• Good communication, documentation, and collaboration skills.

Preferred Qualifications

• Experience with security monitoring, threat detection, vulnerability management, or incident response.
• Hands-on experience with cloud security implementation and configuration.
• Familiarity with security monitoring tools, such as Security Information and Event Management (SIEM) or Endpoint Detection and Response (EDR) solutions.
• Knowledge of security frameworks and industry best practices, such as ISO 27001, NIST Cybersecurity Framework, or CIS Controls.
• Relevant certifications in information security or cloud security, such as CompTIA Security+, AWS Certified Security – Specialty, Microsoft Certified: Azure Security Engineer Associate, or equivalent qualifications.

Benefits

By submitting your resume/CV, you consent and agree to allow the information provided to be used and processed by or on behalf of Xtremax Pte Ltd for purposes related to your registration of interest in current or future employment with us and for the processing of your application for employment.

You also represent to us that you have obtained the consent of your referees when you disclose to us their personal data for the purpose of conducting reference checks.

The personal data held by us relating to your application will be kept strictly confidential and in accordance with the PDPA. You may also refer to our Privacy Policy for more details here: 

We regret to inform you that should you not consent to providing the necessary data required for us to process your application, your application will be considered void.