Senior SecOps Specialist

Responsibilities:

· Develop and maintain security policies, standards and procedures across the organization. Conduct security assessment/security audits to ensure compliance on security policies, standards and procedures.

· Implement security controls to ensure compliance with policies, standards and procedures as well as industry standards (e.g. ISO27001, SOC2 Type2), laws and regulations (e.g. BOT, SEC, PDPA).

· Providing support for audit requests, including Internal Audit, External Audit, ISO Audit, Customer Audit & Questionnaires

· Conduct third party security management including third party security assessment and security contract review.

· Manage and coordinate with stakeholders including vendors on implementation and configuration and maintenance of security technologies (e.g. Firewall, IDS/IPS, EDR, WAF, DLP, SIEM).

· Identify and mitigate vulnerabilities in the organization's systems and networks. Notify related Business Unit on Common Vulnerabilities and Exposures (CVEs). Hosting the Patch Management Meeting with the system owners, developer, and server operation team, as well as recommending a solution.

· Coordination for Penetration Testing (External Pen-tester). Analyze penetration testing result and coordinate with system owners and developer for resolutions.

· Ensure source code review/source code scanning is conducted. Analyze review/scanning result and coordinate with system owners and developer for resolutions.

· Tracking out-of-date anti-virus and/or Endpoint Detection and response (EDR) software and definitions on client and server.

· Managing SOC (3rd party-Security Operation Center) Incident Tickets and Responding as part of a security incident response team. Serve as an expert in delivering and coordinating technical analysis, business impact assessments and mitigation recommendations for security incidents

· Continuously monitoring new security technology and best practices to ensure that the organization's security posture remains up-to-date and effective.

· Oversee and implement physical security (e.g. CCTV, fire distinguisher, aid condition, humidity)

· Raise security awareness by providing ad-hoc training to employees

Qualifications:

· Bachelor's degree or higher in Computer Science, Computer Engineering, Information Security, or a related field.

· Minimum of 5 years' experience in IT Security, IT Compliance, Information Security Risk management or IT Audit field

· Familiarity with security frameworks (such as ISO27001, NIST Cybersecurity framework, SOC 2 Type 2) and risk management approaches.

· Knowledge of digital forensics, vulnerability management, patch management, penetration testing process.

· Familiarity with Strong Authentication, Endpoint Security, Internet Policy Enforcement, Firewalls, Web Content Filtering, Database Activity Monitoring (DAM), Public Key Infrastructure (PKI), Data Loss Prevention (DLP), and Identity and Access Management (IAM) and/or Privilege Access Management (PAM), Cloud security posture management (CSPM), Cloud workload prevention and protection (CWPP), Security Operation Center (SOC).

· Familiarity with security incident management process.

· Equip with CC, CEH, CISSP, CISA, CISM, CompTIA Pentest+, ITIL, and ISO27001 certification would be a plus.

· Interest in security technology and strong security mindset

· Good communication abilities both Thai and English.

Successful candidate may be subject to a criminal background check. Where consent is legally required, the Company will seek your consent prior to conducting such check. The Company reserves the right not to proceed with the hiring process if the background check cannot be conducted.

Orbix Holdings gives an important to Privacy Notice for candidates, we’ll always treat your data with the utmost care. Please click on the links below to find out more about our Privacy Notice for candidates: https://www.orbixholdings.com/docs/Privacy%20Notice%20for%20Candidate.pdf