Cybersecurity Platform Engineer

Key Responsibilities

1. Platform Availability & Health Monitoring

• Perform daily platform uptime and resource checks, including CPU, RAM, and disk usage.
• Monitor daily SIEM log flow and perform weekly backup integrity checks.

2. Provisioning & Change Management

• Deploy, update, and manage EDR agents and agent groups.
• Administer NGFW security policies, NAT, and network objects.
• Install and maintain SIEM collectors.
• Update IOC/IOA and support the development of security detection use cases.
• Perform changes according to established change-control procedures.

3. Security Optimization & Tuning

• Tune EDR behavioural alerts and reduce false positives.
• Optimize NGFW security profiles, including IPS, App-ID, and URL Filtering.
• Fine-tune SIEM correlation rules and detection use cases.

4. Maintenance & Patching

• Maintain consoles, agents, firmware, and operating systems on stable and supported versions.
• Perform regular agent-health audits.
• Ensure fail-safe mechanisms are ready for operation.

5. Governance, Access & Reporting

• Conduct quarterly user access and privilege reviews.
• Monitor license and subscription expiry dates.
• Prepare compliance dashboards and operational/security reports, including PCI and BOT-related reporting.

6. Monthly Customer Meeting

• Attend monthly on-site customer meetings.
• Present the Monthly Operational Report covering platform readiness, completed activities, identified risks, and recommendations.

7. CSOC Coordination & Escalation

• Coordinate with the CSOC and support containment activities as directed, such as blocking URLs or websites through Forcepoint SWG.
• Escalate complex changes, incidents, and requests that fall outside the agreed Scope of Work (SOW).

8. Scope of Work Compliance

• Deliver services according to each customer's active contract and Scope of Work.
• Maintain accurate records of all changes and activities performed.

---

Job Qualifications

• Education: Bachelor's degree or diploma in Computer Science, Information Technology, Computer Engineering, Networking, or a related field.
• Experience: 0–2 years of relevant experience. New graduates are welcome. Internship, laboratory, project, or coursework experience will also be considered.
• English Skills: Able to read technical documentation and vendor procedures in English and write clear operational notes. Thai communication skills are required for customer meetings.
• Operating Systems & Command Line: Basic knowledge of Linux and Windows, including command-line navigation, service and log checking, SSH connection, and executing vendor commands.
• Networking Fundamentals: Basic understanding of TCP/IP, routing, NAT, network interfaces, VPN, and High Availability (HA).
• Cybersecurity Fundamentals: Understanding of key security concepts such as the CIA Triad, Defense-in-Depth, Least Privilege, and common cybersecurity threats and vulnerabilities.
• Change Management & Troubleshooting: Able to follow change-control and ticketing procedures, review logs, interpret system-health information, and investigate alerts.
• Reporting & Dashboards: Able to prepare clear operational and compliance reports. Basic awareness of PCI-DSS and Bank of Thailand (BOT) requirements is an advantage.