AVP, SIEM & SRE Engineering, Technology Group at GIC Private… · SG

Location: Singapore

Job Function: Technology Group

Job Type: Permanent

Req ID: 17222

Recruiter: Yvonne Loh

GIC is one of the world’s largest sovereign wealth funds. With over 2,000 employees across 11 locations around the world, we invest in more than 40 countries globally across asset classes and businesses. Working at GIC gives you exposure to an extraordinary network of the world’s industry leaders. As a leading global long-term investor, we Work at the Point of Impact for Singapore’s financial future, and the communities we invest in worldwide.

Technology Group We experiment, design, and lead a 24×7 global business where we support core capabilities in asset management, trading, investment operations, and risk management. We deliver secure, reliable, and integrated solutions, and provide insights on new, and emerging technologies.

Infrastructure & Cybersecurity Resilience (ICR) We design, build, and secure the technology foundations that power GIC’s global investment operations. We aim to deliver resilient, scalable, and secure infrastructure that empowers our people and businesses to perform securely, efficiently, and effectively.

What impact will you make in this role?

As an AVP/VP SIEM & Datalake Engineer, you will lead the design, implementation, and optimization of enterprise observability and reliability solutions across infrastructure and application domains. You will leverage Splunk and complementary monitoring platforms to drive proactive alerting, automation, and resilience—ensuring operational stability, risk control, and compliance with financial regulatory standards. This is an individual contributor and deep hands-on role.

What will you do as a VP, SRE Engineer (Splunk)?

Observability Engineering & Governance

• Architect and maintain enterprise SIEM/Databricks Lakewatch solutions aligned with operational resilience mandates (e.g., MAS TRM, DORA, APRA CPS 230).
• Lead deployment, configuration, and optimization of SIEM/DataLake for full-stack visibility across infrastructure, applications, networks, and user experience.
• Define and enforce telemetry data governance standards—metrics, logs, and traces—ensuring consistency, retention compliance, and security.
• Integrate Splunk with incident management, ITSM, and AIOps systems to enable predictive alerting and anomaly detection.
• Act as the SIEM/Splunk subject matter expert (SME) for architecture reviews, platform upgrades, and performance tuning.

Reliability Engineering & Automation

• Implement and champion SRE frameworks and reliability practices for mission-critical systems.
• Design and automate runbooks, alerts, and self-healing workflows using Python, Ansible, and Terraform.
• Collaborate with Application, Infrastructure, and Cyber teams to embed reliability principles into the delivery lifecycle.
• Conduct resilience, chaos, and capacity testing aligned with business continuity and disaster recovery standards.
• Define and track error budgets, reliability scorecards, and service health indicators for production workloads.

Cloud & Platform Integration

• Engineer SIEM/DataLake for cloud-native workloads in AWS and Azure, ensuring visibility across compute, storage, and network layers.
• Integrate SIEM/DataLake and cloud observability tools into CI/CD pipelines and landing zones to ensure continuous compliance.
• Implement infrastructure-as-code (IaC) models using Terraform and Ansible for consistent, auditable provisioning.
• Collaborate with Cloud, DevOps, and Security teams to ensure telemetry aligns with audit, compliance, and operational risk requirements.

Operational Excellence & Collaboration

• Drive reduction in incident recurrence, MTTR, and manual intervention through observability-led automation.
• Partner with Service Delivery, Cyber, and Application teams to enable predictive incident prevention and root cause transparency.
• Develop and maintain executive dashboards and reports showcasing availability, reliability KPIs, and operational risk indicators.
• Provide technical leadership during major incidents, post-incident reviews, and audits, ensuring lessons learned are codified into automation and process improvements.

What makes you a successful candidate?

• Bachelor’s or Master’s degree in computer science, Engineering, or related discipline.
• 10+ years’ experience in Infrastructure, Cloud, or SRE roles, with at least 5+ years specializing in SIEM/Lakewatch engineering or observability in financial or regulated environments.
• Proven hands-on expertise in:
  • SIEM Platforms: Splunk (must), EL/Elastic
  • Automation / IaC: Terraform, Ansible, Python, CI/CD tools
  • Cloud Platforms: AWS (CloudWatch, X-Ray, CloudTrail), Azure (Monitor, Log Analytics, App Insights), Datadog, ServiceNow
• Deep understanding of SRE principles, service health modelling, error budgets, and auto-remediation design.
• Strong analytical and troubleshooting skills, with the ability to perform deep-dive investigations and develop long-term preventive solutions.
• Familiarity with financial sector operational resilience frameworks, regulatory compliance, and incident governance.
• Data Lake & Large-Scale Data Platform Expertise: Hands-on experience building, managing, and optimising distributed data systems (e.g., Databricks Lakewatch, AWS S3, Azure Data Lake, GCP BigQuery, Snowflake); proficiency with ETL/ELT tooling (Apache Spark, Kafka, Airflow, Glue); strong SQL and Python/Scala skills; and knowledge of data modelling and governance — schema design, partitioning, metadata management, data cataloguing, lineage, and access control.
• SIEM, Detection Engineering & Response: Hands-on with leading SIEM platforms (Databricks, Splunk, Microsoft Sentinel) and integration of diverse log sources (network, endpoint, cloud, identity); detection engineering including correlation rules, detection logic, and alert tuning, with familiarity with the MITRE ATT&CK framework and threat hunting; and automation/response experience using SOAR tools and scripted playbooks (Python, PowerShell, etc.).
• Agentic AI / Applied AI for Security & Data: Understanding of LLM integration — prompt engineering, retrieval-augmented generation (RAG), and vector databases (e.g., Pinecone, FAISS, Weaviate) — and experience building AI agents that interact with APIs, data sources, and workflows; applied security AI use cases such as AI-assisted threat triage, anomaly detection, incident summarisation, and natural-language interfaces for querying SIEM or data lakes; and MLOps/AIOps familiarity with model deployment, monitoring, and feedback loops using frameworks such as LangChain, LlamaIndex, or OpenAI function calling.
• Cross-Domain Integration: Ability to integrate SIEM logs into the data lake and expose them to AI agents via APIs and data connectors; understanding of event-driven, streaming pipelines (Kafka, Kinesis) for real-time analytics; and knowledge of how to structure data to serve both analytics and compliance (security and data synergy).

Preferred Certifications:

• Splunk/Databricks Certified Admin / Certified Architect
• Terraform / Ansible / Python Certified Expert
• AWS Certified DevOps Engineer / Azure DevOps Expert
• SRE Foundation / Practitioner (DevOps Institute)
• ITIL v4 Managing Professional

Work at the Point of Impact We need to be forward-looking to attract the right people to help us become the Leading Global Long-term Investor. Join our ambitious, agile, and diverse teams - be empowered to push boundaries and pursue innovative ideas, share your views, and be heard. Be anchored on our PRIME Values: Prudence, Respect, Integrity, Merit and Excellence, which guides us in how we make our day-to-day decisions. We strive to inspire. To make an impact.

GIC is a Great Place to Work

At GIC, our offices are vibrant hubs for ideation, professional growth, and interpersonal connection. At the same time, we believe that flexibility allows us to do our best work and be our best selves. Thus, our teams come into the office four days per week to harness the benefits of in-person collaboration, but have the flexibility to choose which days they work from home and adjust this arrangement as situational needs arise.

GIC is an equal opportunity employer As an employer, we passionately believe every individual brings with them unique diversity of thought and perspectives to meaningfully enrich perspectives of GIC teams to drive competitive performance. An inclusive environment yields exceptional contribution.

Learn more about our Technology Group here: https://gic.careers/group/technology-group/