Senior Associate, SOC Platform Engineer

Job Summary:

We are seeking a skilled and motivated SOC Platform Engineer to support our cybersecurity operations through the deployment, integration, and optimization of modern SIEM solutions. The ideal candidate will have hands-on experience with Splunk, Logstash, Devo, Cortex XSIAM, CS Next-Gen SIEM platforms, Qradar, Arcsight and Microsoft Azure Sentinel, playing a key role in threat detection, incident response, and compliance

Principal Accountabilities:

• Design, implement, and maintain SIEM platforms including Splunk, Azure Sentinel, Logstash, Devo,CS NG-SIEM and XSIAM.Qradar,Arcsight
• Integrate various log sources (on-premise and cloud) with SIEM platforms to ensure comprehensive visibility
• Develop and fine-tune correlation rules, detection content, dashboards, and alerts for security monitoring
• Conduct log parsing, data normalization, and field extraction
• Monitor SIEM performance and scalability; troubleshoot ingestion, parsing, and alerting issues
• Collaborate with SOC analysts and threat intelligence teams to refine use cases and improve threat detection capabilities
• Automate log ingestion and parsing using scripting and configuration management tools
• Conduct threat hunting using SIEM data and contribute to proactive threat identification
• Assist with incident response activities and forensic investigations using SIEM data
• Maintain compliance reporting and audit support using built-in and custom dashboards

Qualifications:

• Bachelor’s degree in Computer Science, Information Security, Information Technology, Cybersecurity, or a related field
• 2-5 years of experience working with SIEM platforms
• Hands-on experience with at least two or more of the following: Splunk, Logstash, Devo, Cortex XSIAM, Azure Sentinel, CS Next-Gen SIEM platforms
• Strong understanding of log ingestion pipelines, parsing techniques, and data normalization
• Experience in developing custom detection rules, dashboards, and correlation searches
• Knowledge of cloud security logging (Azure, AWS, GCP,OCI)
• Familiarity with MITRE ATT&CK framework, KQL, SPL, Sigma rules, and threat intelligence feeds
• Proficiency in Linux/Windows environments, scripting (Python, PowerShell), and RESTful APIs
• Strong troubleshooting and analytical skills in a cybersecurity context
• Certifications such as Splunk Certified Admin/Architect, Microsoft SC-200, Elastic Certified Engineer
• Experience in cloud-native SIEM environments
• Background in SOC operations, incident response, or threat detection
• Understanding of Zero Trust, EDR,XDR, and SOAR platforms
• Good command on both English and Thai

Work Location: True Digital Park