Cyber Platform Engineer

(Contract) Location:  Singapore (Onsite at various secured premises) Employment Type:  Contract About the Role We are seeking a skilled  Cyber Platform Engineer  to join our team and take ownership of the operational administration, maintenance, and lifecycle management of our organization's critical cybersecurity platforms. This is a hands-on role that requires strong technical expertise, disciplined change management, and a commitment to security compliance. The successful candidate will manage and maintain: Palo Alto Next-Generation Firewalls  across multiple sites

Carbon Black EDR  platform (server and sensor management)

Cloudflare DDoS Mitigation Services (DMS)  and Web Application Firewall

CyberArk Privileged Access Management (PAM)  platform

This role involves regular onsite visits, quarterly preventive maintenance, and close coordination with internal stakeholders and vendors. The engineer must ensure all activities comply with organizational cybersecurity policies and regulatory requirements, including the Cybersecurity Act and applicable Codes of Practice. Key Responsibilities Palo Alto Firewall Operations & Maintenance Perform comprehensive quarterly preventive maintenance of all onsite perimeter firewalls, including health checks, patching, firmware updates, and diagnostics.

Conduct quarterly log and account reviews to detect anomalies and ensure policy compliance.

Execute patching and mitigations based on the organizational patch management timeline: Critical vulnerabilities: within 45 days

High/Medium vulnerabilities: within 60 days

Low vulnerabilities: within 90 days

Conduct annual firewall configuration and rules reviews, and periodic security reviews.

Perform ad-hoc onsite maintenance, including graceful shutdowns (up to 3 times per quarter), replacement of faulty devices or parts (e.g., Ethernet cables), and cabling services.

Provide configuration services including signature updates, CVE patching, log backup extraction, firewall rules whitelisting, and system configuration.

Support cybersecurity assessments and audits related to firewall infrastructure.

Ensure all firewall rules, configurations, and operations remain compliant throughout the contract period.

Raise change requests in accordance with the organizational Change Management process.

EDR Platform Operations & Maintenance Maintain and operate Carbon Black EDR servers hosted on RHEL 8, covering OS, database, application, backup, health checks, patching, and service maintenance.

Monitor and troubleshoot Carbon Black application services, PostgreSQL/Solr components, log forwarding, and indexing/queue issues.

Review system, security, and audit logs not centrally forwarded.

Monitor endpoint sensor health, connectivity, and deployment status; troubleshoot offline or faulty sensors, collect diagnostics, and support sensor recovery or redeployment.

Support onboarding of new endpoints and validate sensor records against asset inventories.

Coordinate with the OEM for advanced troubleshooting, configuration, integration, and professional support when required.

Cloudflare DMS Administration Serve as the first point of contact for all DMS-related enquiries from internal stakeholders.

Perform monthly user access reviews, log reviews, and report reviews from the managed services vendor.

Manage onboarding and offboarding of websites on the DMS platform, ensuring all changes are documented in the enterprise cloud repository.

Update and maintain DMS-related documentation, templates, and default configurations.

Manage software/hardware maintenance and warranty tracking for DMS components.

Process service requests and change requests, including security policy changes (IP whitelisting/blacklisting), log extraction, and notification alert updates.

Manage SSL certificate renewals for protected websites and update website maintenance pages as required.

Review and optimize DMS rules and notifications in coordination with the vendor and SOC team.

Perform continuous monitoring and review of the DMS solution every six months to ensure ongoing effectiveness.

Update the Business Impact Assessment (BIA) form annually and manage privileged ID password expiry records.

CyberArk PAM Administration Serve as the first point of contact for all PAM-related enquiries and ad-hoc requests.

Support investigation and incident response activities as required.

Perform monthly user access reviews to ensure only authorized personnel retain access to privileged accounts.

Manage onboarding and offboarding of privileged accounts into CyberArk.

Process service requests and change requests related to privileged account management.

Update the BIA form annually and manage privileged ID password expiry in accordance with organizational policy.

Security & Compliance Ensure all platforms comply with organizational cybersecurity policies, the Cybersecurity Act, and applicable Codes of Practice.

Comply with written instructions on cybersecurity-related matters issued by government authorities and the organization.

Ensure data and information across all platforms are protected from leakage, loss, destruction, and falsification in accordance with statutory, regulatory, contractual, and business requirements.

Sign confidentiality agreements and handle security-classified or sensitive information only as authorized in writing.

Security Incident & Response Report all security incidents (virus infections, compromises, unauthorized access, vulnerabilities) immediately.

Support investigations and incident response by retrieving relevant logs, configurations, and platform data.

Generate detailed incident investigation reports for each incident.

Implement preventive measures to thwart recurrence of security incidents.

Backup & Restoration Maintain and update the backup and restoration plan for all platforms, including scope, frequency, type, storage location, access controls, restoration procedures, verification, and protection measures.

Ensure system configuration backups are completed before and after system changes, and verify scheduled backups are successful.

Ensure backups are stored securely, separately from production systems, and in offline storage where required.

Coordinate and document annual backup restoration testing, track remediation of issues, and review the backup plan at least once every 12 months.

Maintain backup records and evidence for cybersecurity assessments and audits.

Reporting & Documentation Produce maintenance reports for applicable platforms after every maintenance cycle, including: Summary status report of completed jobs, ad-hoc support, and outstanding jobs

Platform health checklists (firewall, DMS, PAM)

System, security, and audit log review findings

Software security patch status and tracking

Backup records and evidence

Software licence subscription expiry tracking

Action items on outstanding matters

Maintain SOPs, asset inventories, system configuration notes, and troubleshooting guides for all platforms.

Maintain and update the enterprise cloud repository with the latest documentation, templates, and status records.

Maintain security dashboards or trackers for vulnerabilities, deviations, access reviews, and audit items across all platforms.

Technical Requirements Mandatory Skills Strong foundation in enterprise networking, including TCP/IP, VLANs, routing, NAT, DNS, network segmentation, firewall traffic flow, and network troubleshooting.

Hands-on experience with  Palo Alto Networks Next-Generation Firewalls  (or equivalent), including policy/rule management, NAT, routing, security profiles, log analysis, patching, firmware upgrades, and configuration backup/restoration.

Hands-on experience with  Carbon Black EDR  (or equivalent), including server administration, sensor health monitoring and troubleshooting, log review, endpoint onboarding, and maintenance of supporting OS/application services.

Experience with  Cloudflare  (or equivalent DDoS mitigation and WAF platforms), including WAF/security rules, IP whitelisting/blacklisting, SSL certificate management, log review, and website onboarding/offboarding.

Experience with  CyberArk PAM  (or equivalent privileged access management solutions), including privileged account onboarding/offboarding, access management, password rotation, session management, and audit log review.

Understanding of secure network environments, including air-gapped networks, restricted connectivity, controlled offline transfer of patches/files, and use of data diodes or unidirectional gateways.

Good-to-Have Skills Strong understanding of network security concepts including firewall policies, IPS, application-layer inspection, high availability, and secure administrative access.

Familiarity with vulnerability assessment, patch management, security hardening, change management, and cybersecurity incident response processes.

Experience supporting cybersecurity platforms within highly secured, segregated, or air-gapped enterprise network environments.

Familiarity with PKI and TLS/SSL certificate lifecycle management.

Preferred Certifications CCNA  or equivalent networking certification -highly preferred.

Palo Alto Networks Certified Next-Generation Firewall Engineer  or equivalent - preferred.

CyberArk Defender – PAM  - preferred;  CyberArk Sentry – PAM  will be advantageous.

Relevant  Cloudflare  technical certification, accreditation, or recognized training in WAF/DDoS administration -advantageous.

Working Arrangement Onsite at designated secure premises across Singapore, as required for quarterly preventive maintenance or ad-hoc works.

Expected to complete scheduled quarterly maintenance windows and ad-hoc response for onsite troubleshooting. Time-off will be given for work performed after office hours.

The engineer will be subjected to  security clearance  prior to commencement of work. Clearance processing takes  at least four weeks .