---

About this position

The Senior Security Operations Specialist is responsible for developing and maintaining security policies, implementing security controls, managing third-party security, and ensuring compliance with industry standards and regulations.

Responsibilities

• Develop and maintain security policies, standards and procedures across the organization. Conduct security assessment/security audits to ensure compliance on security policies, standards and procedures.
• Implement security controls to ensure compliance with policies, standards and procedures as well as industry standards (e.g. ISO27001, SOC2 Type2), laws and regulations (e.g. BOT, SEC, PDPA).
• Providing support for audit requests, including Internal Audit, External Audit, ISO Audit, Customer Audit & Questionnaires.
• Conduct third party security management including third party security assessment and security contract review.
• Manage and coordinate with stakeholders including vendors on implementation and configuration and maintenance of security technologies (e.g. Firewall, IDS/IPS, EDR, WAF, DLP, SIEM).
• Identify and mitigate vulnerabilities in the organization's systems and networks. Notify related Business Unit on Common Vulnerabilities and Exposures (CVEs). Hosting the Patch Management Meeting with the system owners, developer, and server operation team, as well as recommending a solution.
• Coordination for Penetration Testing (External Pen-tester). Analyse penetration testing result and coordinate with system owners and developer for resolutions.
• Ensure source code review/source code scanning is conducted. Analyse review/scanning result and coordinate with system owners and developer for resolutions.
• Tracking out-of-date anti-virus and/or Endpoint Detection and response (EDR) software and definitions on client and server.
• Managing SOC (3rd party-Security Operation Center) Incident Tickets and Responding as part of a security incident response team. Serve as an expert in delivering and coordinating technical analysis, business impact assessments and mitigation recommendations for security incidents.
• Continuously monitoring new security technology and best practices to ensure that the organization's security posture remains up-to-date and effective.
• Oversee and implement physical security (e.g. CCTV, fire distinguisher, aid condition, humidity).
• Raise security awareness by providing ad-hoc training to employees.

Requirements

• Bachelor's degree or higher in Computer Science, Computer Engineering, Information Security, or a related field.
• Minimum of 5 years' experience in IT Security, IT Compliance, Information Security Risk management or IT Audit field.
• Familiarity with security frameworks (such as ISO27001, NIST Cybersecurity framework, SOC 2 Type 2) and risk management approaches.
• Knowledge of digital forensics, vulnerability management, patch management, penetration testing process.
• Familiarity with Strong Authentication, Endpoint Security, Internet Policy Enforcement, Firewalls, Web Content Filtering, Database Activity Monitoring (DAM), Public Key Infrastructure (PKI), Data Loss Prevention (DLP), and Identity and Access Management (IAM) and/or Privilege Access Management (PAM), Cloud security posture management (CSPM), Cloud workload prevention and protection (CWPP), Security Operation Center (SOC).
• Familiarity with security incident management process.
• Equip with CC, CEH, CISSP.

Benefits