Cyber Platform Engineer

V4 IMPACT PTE. LTD.; Singapore; On-site; SGD 110,000 - 170,000; Full time

Job summary

V4 IMPACT PTE. LTD. requires a Cyber Platform Engineer to oversee operational administration, maintenance, and lifecycle management of cybersecurity platforms including Palo Alto firewalls, Carbon Black EDR, Cloudflare DMS, and CyberArk PAM.

The role emphasizes change management, documentation, and compliance with cybersecurity policies. You will coordinate with contractors and internal teams, perform maintenance cycles, and generate detailed reports to support security posture across multiple

Qualifications

• Hands-on with Palo Alto Networks firewalls (NGFW) and policy management.
• Experience with Carbon Black EDR server administration and sensor deployment.
• Familiarity with Cloudflare DMS + SSL management and onboarding/offboarding workflows.
• Experience with CyberArk PAM onboarding/offboarding and password management.
• Understanding of change management processes and security policy compliance.
• Ability to support cybersecurity assessments and audits.

Responsibilities

• Perform quarterly preventive maintenance on on-site Palo Alto firewalls, health checks, patches, and firmware updates.
• Conduct quarterly log and account reviews for policy compliance.
• Manage DMS onboarding/offboarding and documentation in enterprise repo.
• Maintain Carbon Black EDR servers: OS, DB, logs, patching, backups.
• Provide maintenance reports after each cycle and ensure CCOP compliance.
• Support cyber incident investigations and response activities.

Skills

Palo Alto Firewalls

Carbon Black EDR

Cloudflare DMS

CyberArk PAM

Change Management

Security Audits & Assessments

Tools

RHEL 8

PostgreSQL/Solr

Job description

Job Description & Requirements

Scope of Work

The Cyber Platform Engineer will be responsible for the operational administration, maintenance, and lifecycle management of the Board’s key cybersecurity platforms: Carbon Black EDR, Palo Alto Perimeter Firewalls deployed across the Board's Critical Information Infrastructure (CII)sites, the Cloudflare DDoS Mitigation Services (DMS) protecting the Board's internet-facing web assets, and the CyberArk Privileged Access Management (PAM)platform governing privileged account access across the Board's environment.

The engineer will execute routine and ad-hoc maintenance activities to ensure the continuous functioning, security compliance, and operational integrity of these platforms. This includes performing scheduled preventive maintenance, managing onboarding and offboarding of assets and accounts, conducting access and log reviews, supporting security assessment sand audits, and coordinating with relevant contractors and internal teams. The engineer shall also produce maintenance reports according to Board requirements for every maintenance cycle.

This role requires strong discipline around cybersecurity, change management, and documentation, and the engineer shall ensure all activities are compliant with the Board's cybersecurity policies and the Cybersecurity Code of Practice (CCoP).

Palo Alto Firewall Operations & Maintenance

• Perform comprehensive quarterly preventive maintenance ofall onsite perimeter firewalls, meaning onsite visits to all Board's sites, covering health checks, software patching and firmware updates, and diagnostic checks.
• Conduct quarterly log and account reviews to detect anomalies and ensure compliance with the Board's cybersecurity policies.
• Perform patching and mitigations based on the Board's patch management timeline: Critical vulnerabilities within 45 days, High and Medium within 60 days, and Low within 90 days.
• Perform annual firewall configuration and rules reviews, annual review of hardware and software application lists, and other periodic security reviews as required by the Board's cybersecurity policy.
• Perform ad-hoc onsite maintenance including graceful shutdown of firewalls when required by the Board (not more than thrice per quarter), and replacement of faulty devices or parts such as ethernet cables.
• Perform configuration services for existing perimeter firewalls across CII sites, including signature updates and CVE patching on an ad-hoc basis, log backup extraction, firewall shifting and cabling services, firewall rules whitelisting and configuration, and system configuration.
• Assist the Board during cybersecurity assessments and audits related to the firewall infrastructure.
• Ensure firewall rules, configurations, and operations comply with the Board's cybersecurity policies and requirements throughout the entire contract period.
• Raise change requests according to the Board's Change Management process for all maintenance works and system changes.

EDR Platform Operations & Maintenance

• Maintain and operate Carbon Black EDR servers hosted on RHEL 8, including OS, database, application, backup, health check, patching, and service maintenance activities.
• Monitor and troubleshoot Carbon Black application services, PostgreSQL/Solr components, log forwarding services, and indexing or queue-related issues, including review of system, security, and audit logs not centrally forwarded.
• Monitor endpoint sensor health, connectivity, and deployment status; troubleshoot offline or faulty sensors, collect diagnostics, and support sensor recovery or redeployment.
• Support onboarding of new endpoints, validate sensor records against asset inventories, and coordinate with the OEM for advanced troubleshooting, configuration, integration, and professional support when required.

Cloudflare DMS Administration

• Serve as the first point of contact for all DMS-related enquiries from internal stakeholders.
• Perform monthly user access reviews, log reviews, and report reviews from the managed services vendor for Cloudflare DMS platform.
• Manage onboarding of new websites onto the DMS platform and offboarding of websites when required, ensuring all changes are documented in the Board’s enterprise cloud repository.
• Update and maintain DMS-related documentation, templates, and default configurations in the Board’s enterprise cloud repository as required.
• Manage software and hardware maintenance and warranty tracking for DMS components.
• Process service requests and change requests including security policy changes such as IP whitelisting and blacklisting, log extraction, and notification alert updates.
• Manage SSL certificate renewals for protected websites and update website maintenance pages as required.
• Review and optimise DMS rules and notifications incoordination with the vendor and SOC team.
• Perform continuous monitoring and review of the DMS solution every six months to ensure ongoing effectiveness against an evolving threat landscape.
• Update the Business Impact Assessment (BIA) form annually and update privileged ID password expiry records.

CyberArk PAM Administration

• Serve as the first point of contact for all PAM-related enquiries from internal stakeholders and ad-hoc requests.
• Support investigation and incident response activities, as required.
• Perform monthly user access reviews to ensure only authorised personnel retain access to privileged accounts.
• Manage onboarding of new privileged accounts into CyberArk and offboarding of accounts when no longer required.
• Process service requests and change requests related to privileged account management.
• Update the BIA form annually and manage privileged ID password expiry in accordance with the Board's cybersecurity policy.

Security & Compliance

• Ensure all three platforms comply with the Board's cybersecurity policies, the Cybersecurity Act requirements by the CyberSecurity Agency (CSA), and the Cybersecurity Code of Practice (CCoP).
• Comply with any written instructions on cybersecurity-related matters issued by the Government and the Board from time to time.
• Ensure data and information across all platforms are protected from leakage, loss, destruction, and falsification in accordance with statutory, regulatory, contractual, and business requirements.
• All personnel shall sign confidentiality agreements prescribed by the Board and shall not disclose security-classified or sensitive information unless specifically authorised in writing by the Board.

Security Incident & Response

• Report all security incidents such as virus infections, security compromises, unauthorised access, and security vulnerabilities to the Board immediately.
• Support investigations and incident response activities by retrieving relevant logs, configurations, and platform data as required.
• Generate detailed incident investigation reports for each incident and submit to the Board.
• Implement preventive measures to thwart the recurrence of security incidents.

Backup & Restoration

• Maintain and update the backup and restoration plan for the platforms, including backup scope, frequency, type, storage location, access controls, restoration procedures, verification, and protection measures.
• Ensure system configuration backups are completed before and after system changes and verify that scheduled backups are completed successfully.
• Ensure backups are stored securely, separately from the corresponding production systems in offline storage where required by the Board's cybersecurity policy.
• Coordinate and document annual backup restoration testing, track remediation of any restoration issues, and review the backup and restoration plan at least once every 12 months.
• Maintain backup records and evidence, including backup status, restoration test results, exceptions, and outstanding actions, for cybersecurity assessments and audits.

Reporting & Documentation

Produce maintenance reports for applicable platforms after every maintenance cycle. The report shall minimally include:

• Summary status report of completed jobs, ad-hoc support, and outstanding jobs;
• Platform health checklists for firewall, DMS, and PAM;
• System, security, and audit log review findings;
• Software security patch status and tracking;
• Update backup records and evidence if applicable;
• Tracking of software licence subscription expiry;
• Action items on outstanding matters with the Board.

Maintain SOPs, asset inventories, system configuration notes, and troubleshooting guides for all three platforms.

Maintain and update the Board’s enterprise cloud repository with the latest documentation, templates, and status records.

Maintain security dashboards or trackers for vulnerabilities, deviations, access reviews, and audit items across all platforms.

Technical Requirements

Mandatory Technical Skills

• Strong foundation in enterprise networking, including TCP/IP, VLANs, routing, NAT, DNS, network segmentation, firewall traffic flow, and network troubleshooting.
• Hands-on experience with Palo Alto Networks Next-Generation Firewalls or equivalent firewall platforms, including firewall policy and rule management, NAT, routing, security profiles, log analysis, patching, firmware upgrades, and configuration backup/restoration.
• Hands-on experience with Carbon Black EDR or equivalent endpoint detection and response platforms, including server administration, sensor health monitoring and troubleshooting, log review, endpoint onboarding, and basic maintenance of supporting OS and application services.
• Experience with Cloudflare or equivalent DDoS mitigation and Web Application Firewall platforms, including WAF/security rules, IP whitelisting and blacklisting, SSL certificate management, log review, andwebsite onboarding/offboarding.
• Experience with CyberArk PAM or equivalent privileged access management solutions, including privileged account onboarding/offboarding, access management, password rotation, session management, and audit log review.
• Understanding of secure network environments, including air-gapped networks, restricted network connectivity, controlled offline transfer of patches/files, and the use of data diodes or unidirectional gateways.

Good-to-Have

• Strong understanding of network security concepts including firewall policies, IPS, application-layer inspection, high availability and secure administrative access.
• Familiarity with vulnerability assessment, patch management, security hardening, change management, and cybersecurity incident response processes.
• Experience supporting cybersecurity platforms within highly secured, segregated, or air-gapped enterprise network environments.
• Familiarity with PKI and TLS/SSL certificate lifecycle management.

Certifications

• Cisco Certified Network Associate (CCNA) or equivalent networking certification — highly preferred.
• Palo Alto Networks Certified Next-Generation Firewall Engineer or equivalent current Palo Alto Networks firewall certification —preferred.
• CyberArk Defender – PAM certification — preferred; CyberArk Sentry – PAM will be advantageous.
• Relevant Cloudflare technical certification, accreditation, or recognised training in WAF/DDoS administration will be advantageous