Cyber Platform Engineer

Cyber Platform Engineer

1. Scope of Work

The Cyber Platform Engineer will be responsible for the operational administration, maintenance, and lifecycle management of the Board’s key cybersecurity platforms: Carbon Black EDR, Palo Alto Perimeter Firewalls deployed across the Board's Critical Information Infrastructure (CII) sites, the Cloudflare DDoS Mitigation Services (DMS) protecting the Board's internet-facing web assets, and the CyberArk Privileged Access Management (PAM) platform governing privileged account access across the Board's environment.

The engineer will execute routine and ad-hoc maintenance activities to ensure the continuous functioning, security compliance, and operational integrity of these platforms. This includes performing scheduled preventive maintenance, managing onboarding and offboarding of assets and accounts, conducting access and log reviews, supporting security assessments and audits, and coordinating with relevant contractors and internal teams. The engineer shall also produce maintenance reports according to Board requirements for every maintenance cycle.

This role requires strong discipline around cybersecurity, change management, and documentation, and the engineer shall ensure all activities are compliant with the Board's cybersecurity policies and the Cybersecurity Code of Practice (CCoP).

2. Roles and Responsibilities

Palo Alto Firewall Operations & Maintenance

• Perform comprehensive quarterly preventive maintenance of all onsite perimeter firewalls, meaning onsite visits to all Board's sites, covering health checks, software patching and firmware updates, and diagnostic checks.
• Conduct quarterly log and account reviews to detect anomalies and ensure compliance with the Board's cybersecurity policies.
• Perform patching and mitigations based on the Board's patch management timeline: Critical vulnerabilities within 45 days, High and Medium within 60 days, and Low within 90 days.

• Perform annual firewall configuration and rules reviews, annual review of hardware and software application lists, and other periodic security reviews as required by the Board's cybersecurity policy.
• Perform ad-hoc onsite maintenance including graceful shutdown of firewalls when required by the Board (not more than thrice per quarter), and replacement of faulty devices or parts such as ethernet cables.
• Perform configuration services for existing perimeter firewalls across CII sites, including signature updates and CVE patching on an ad-hoc basis, log backup extraction, firewall shifting and cabling services, firewall rules whitelisting and configuration, and system configuration.
• Assist the Board during cybersecurity assessments and audits related to the firewall infrastructure.
• Ensure firewall rules, configurations, and operations comply with the Board's cybersecurity policies and requirements throughout the entire contract period.
• Raise change requests according to the Board's Change Management process for all maintenance works and system changes.

EDR Platform Operations & Maintenance

• Maintain and operate Carbon Black EDR servers hosted on RHEL 8, including OS, database, application, backup, health check, patching, and service maintenance activities.
• Monitor and troubleshoot Carbon Black application services, PostgreSQL/Solr components, log forwarding services, and indexing or queue-related issues, including review of system, security, and audit logs not centrally forwarded.
• Monitor endpoint sensor health, connectivity, and deployment status; troubleshoot offline or faulty sensors, collect diagnostics, and support sensor recovery or redeployment.
• Support onboarding of new endpoints, validate sensor records against asset inventories, and coordinate with the OEM for advanced troubleshooting, configuration, integration, and professional support when required.

Cloudflare DMS Administration

• Serve as the first point of contact for all DMS-related enquiries from internal stakeholders.
• Perform monthly user access reviews, log reviews, and report reviews from the managed services vendor for Cloudflare DMS platform.
• Manage onboarding of new websites onto the DMS platform and offboarding of websites when required, ensuring all changes are documented in the Board’s enterprise cloud repository.
• Update and maintain DMS-related documentation, templates, and default configurations in the Board’s enterprise cloud repository as required.
• Manage software and hardware maintenance and warranty tracking for DMS components.
• Process service requests and change requests including security policy changes such as IP whitelisting and blacklisting, log extraction, and notification alert updates.
• Manage SSL certificate renewals for protected websites and update website maintenance pages as required.
• Review and optimise DMS rules and notifications in coordination with the vendor and SOC team.
• Perform continuous monitoring and review of the DMS solution every six months to ensure ongoing effectiveness against an evolving threat landscape.
• Update the Business Impact Assessment (BIA) form annually and update privileged ID password expiry records.

CyberArk PAM Administration

• Serve as the first point of contact for all PAM-related enquiries from internal stakeholders and ad-hoc requests.
• Support investigation and incident response activities, as required
• Perform monthly user access reviews to ensure only authorised personnel retain access to privileged accounts.
• Manage onboarding of new privileged accounts into CyberArk and offboarding of accounts when no longer required.
• Process service requests and change requests related to privileged account management.
• Update the BIA form annually and manage privileged ID password expiry in accordance with the Board's cybersecurity policy.

Security & Compliance

• Ensure all three platforms comply with the Board's cybersecurity policies, the Cybersecurity Act requirements by the Cyber Security Agency (CSA), and the Cybersecurity Code of Practice (CCoP).
• Comply with any written instructions on cybersecurity-related matters issued by the Government and the Board from time to time.
• Ensure data and information across all platforms are protected from leakage, loss, destruction, and falsification in accordance with statutory, regulatory, contractual, and business requirements.
• All personnel shall sign confidentiality agreements prescribed by the Board and shall not disclose security-classified or sensitive information unless specifically authorised in writing by the Board.

Security Incident & Response

• Report all security incidents such as virus infections, security compromises, unauthorised access, and security vulnerabilities to the Board immediately.
• Support investigations and incident response activities by retrieving relevant logs, configurations, and platform data as required.
• Generate detailed incident investigation reports for each incident and submit to the Board.
• Implement preventive measures to thwart the recurrence of security incidents.

Backup & Restoration

• Maintain and update the backup and restoration plan for the platforms, including backup scope, frequency, type, storage location, access controls, restoration procedures, verification, and protection measures.
• Ensure system configuration backups are completed before and after system changes and verify that scheduled backups are completed successfully.
• Ensure backups are stored securely, separately from the corresponding production systems in offline storage where required by the Board's cybersecurity policy.
• Coordinate and document annual backup restoration testing, track remediation of any restoration issues, and review the backup and restoration plan at least once every 12 months
• Maintain backup records and evidence, including backup status, restoration test results, exceptions, and outstanding actions, for cybersecurity assessments and audits.

Reporting & Documentation

• Produce maintenance reports for applicable platforms after every maintenance cycle. The report shall minimally include:
  1) Summary status report of completed jobs, ad-hoc support, and outstanding jobs;
  2) Platform health checklists for firewall, DMS, and PAM;
  3) System, security, and audit log review findings;
  4) Software security patch status and tracking;
  5) Update backup records and evidence if applicable;
  6) Tracking of software licence subscription expiry;
  7) Action items on outstanding matters with the Board.

• Maintain SOPs, asset inventories, system configuration notes, and troubleshooting guides for all three platforms.
• Maintain and update the Board’s enterprise cloud repository with the latest documentation, templates, and status records.
• Maintain security dashboards or trackers for vulnerabilities, deviations, access reviews, and audit items across all platforms.

3. Technical Requirements

Mandatory Technical Skills

• Strong foundation in enterprise networking, including TCP/IP, VLANs, routing, NAT, DNS, network segmentation, firewall traffic flow, and network troubleshooting.
• Hands-on experience with Palo Alto Networks Next-Generation Firewalls or equivalent firewall platforms, including firewall policy and rule management, NAT, routing, security profiles, log analysis, patching, firmware upgrades, and configuration backup/restoration.
• Hands-on experience with Carbon Black EDR or equivalent endpoint detection and response platforms, including server administration, sensor health monitoring and troubleshooting, log review, endpoint onboarding, and basic maintenance of supporting OS and application services.
• Experience with Cloudflare or equivalent DDoS mitigation and Web Application Firewall platforms, including WAF/security rules, IP whitelisting and blacklisting, SSL certificate management, log review, and website onboarding/offboarding.
• Experience with CyberArk PAM or equivalent privileged access management solutions, including privileged account onboarding/offboarding, access management, password rotation, session management, and audit log review.
• Understanding of secure network environments, including air-gapped networks, restricted network connectivity, controlled offline transfer of patches/files, and the use of data diodes or unidirectional gateways.

Good-to-Have

• Strong understanding of network security concepts including firewall policies, IPS, application-layer inspection, high availability and secure administrative access.
• Familiarity with vulnerability assessment, patch management, security hardening, change management, and cybersecurity incident response processes.
• Experience supporting cybersecurity platforms within highly secured, segregated, or air-gapped enterprise network environments.
• Familiarity with PKI and TLS/SSL certificate lifecycle management.

Certifications

1. Cisco Certified Network Associate (CCNA) or equivalent networking certification — highly preferred.
2. Palo Alto Networks Certified Next-Generation Firewall Engineer or equivalent current Palo Alto Networks firewall certification — preferred.
3. CyberArk Defender – PAM certification — preferred; CyberArk Sentry – PAM will be advantageous.
4. Relevant Cloudflare technical certification, accreditation, or recognised training in WAF/DDoS administration will be advantageous.

4. Working Arrangement

• Onsite at designated government secure premises across Singapore, as required for quarterly preventive maintenance or ad-hoc works.
• Expected to complete scheduled quarterly maintenance windows and ad-hoc response for onsite troubleshooting. Time off will be given for work performed after office hours.
• Must comply with all security and safety protocols of government premises.