Cybersecurity Adversarial Validation Engineer

Assurity Trusted Solutions (ATS) is a wholly owned subsidiary of the Government Technology Agency (GovTech). As a Trusted Partner over the last decade. ATS offers a comprehensive suite of products and services ranging from infrastructure and operational services, governance and assurance services as well as managed processes. In a dynamic digital & cyber landscape where trust & collaboration is key, ATS continues to drive mutually beneficial business outcomes through collaboration with GovTech, government agencies and commercial partners to mitigate cyber risks and bolster security postures.

About the Role

We are a cybersecurity assurance service provider that helps organizations prove, not assume, that their security controls actually work. Our Adversarial Validation team emulates real adversaries end to end, then works shoulder-to-shoulder with defenders to turn every finding into durable detection and response capability.

We are looking for an Adversarial Validation Engineer who can plan and execute adversary emulation and purple team engagements, and who is equally comfortable translating emulation activity into high-fidelity detection logic in the customer's SIEM and detection stack. If you enjoy both breaking things and making the blue team measurably better, this role is for you!

Key Responsibilities

Adversary Emulation & Purple Teaming

• Plan and execute adversary emulation engagements mapped to MITRE ATT&CK, aligned to realistic threat actors relevant to each customer.
• Run purple team exercises: execute techniques in a controlled manner, observe telemetry, and iterate in real time with customer defenders.
• Validate the effectiveness of preventive, detective, and response controls against emulated TTPs.
• Document execution evidence, timelines, and outcomes to a high standard for both technical and executive audiences.

Detection Engineering (Post-Emulation Focus)

• Own the "after-action" phase: convert emulation results into actionable detection gaps, hypotheses, and coverage maps.
• Author, tune, and validate detection rules in customer SIEM/detection platforms (e.g., Splunk, Microsoft Sentinel/Defender, Elastic, Chronicle, CrowdStrike, SentinelOne, and similar).
• Build high-fidelity detections that balance true-positive yield against alert fatigue, with clear rationale and test cases.
• Create detection-as-code artifacts and validation tests (e.g., Sigma rules, unit tests, ATT&CK coverage heat maps) where the customer environment allows.
• Collaborate with customer detection/SOC teams to deploy, measure, and iterate on new detections.

Engagement Delivery & Client Work

• Support scoping, rules of engagement, deconfliction, and safety/containment planning.
• Produce clear, prioritized findings and remediation guidance for both technical teams and leadership.
• Present results in readouts and workshops, and facilitate knowledge transfer to customer defenders.
• Contribute to internal methodology, tooling, playbooks, and reusable emulation/detection content.

Requirements

• Experience in offensive security, red teaming, purple teaming, detection engineering, or a closely related discipline.
• Solid, hands-on understanding of the MITRE ATT&CK framework and the ability to map activity to techniques.
• Practical experience executing adversary emulation or red team operations end to end.
• Working knowledge of Networking, Windows, Linux and Active Directory attack paths and the telemetry they generate.
• Experience authoring or tuning detection rules in at least one major SIEM/detection platform.
• Clear written and verbal communication, including client-facing report writing and readouts.
• Strong ethics, discipline, and a safety-first mindset for operating in production customer environments.

Preferred Qualifications

• Relevant certifications (e.g., OSCP, CRTO, OSEP, GCIH, GCFA, GCDA, GDAT, or equivalent demonstrable skills).
• MITRE ATT&CK Purple Teaming Methodology certification.
• Detection engineering depth: Sigma, EQL/KQL/SPL, detection-as-code pipelines, ATT&CK coverage tooling (e.g. DeTT&CT, Atomic Red Team).
• Familiarity with cloud (AWS/Azure/GCP) and container/Kubernetes attack and detection surfaces.
• Experience with threat intelligence-driven emulation and adversary tracking.
• Purple team facilitation experience and comfort leading live exercises with defenders.
• Scripting/automation skills (Python, PowerShell, Bash) for emulation and detection tooling.
• Advantageous: applied knowledge of AI/LLM models to improve detection engineering outcomes (e.g., rule generation and reasoning, tuning, triage enrichment, or analyst augmentation).

By submitting your application, you agree that your personal data may be collected, used and disclosed by Assurity Trusted Solutions Pte. Ltd. (ATS), GovTech and their service providers and agents in accordance with ATS’s privacy statement which can be found at: https://www.assurity.sg/ or such other successor site.

Benefits

• A wholly-owned subsidiary of GovTech.
• We promote a learning culture and encourage you to grow and learn.
• Contract Staff enjoys the same benefits as Permanent Employees.