Cybersecurity Operations Engineer

Job Purpose

This role is responsible for supporting the day-to-day operation, monitoring, administration and continuous improvement of the organization's Security Operations Center and security monitoring capabilities. You bridge the gap between cybersecurity operations, IT infrastructure, and compliance.

The role focuses on security event monitoring, log management, UAM/PAM governance, access review, security incident support, security tools administration, systems onboarding, security reporting and audit compliance.

This role works closely with Infrastructure, Network, Cloud, DevOps, Cybersecurity, Risk, Internal Audit, external auditors and technology partners to ensure security events and access activities are appropriately monitored, investigated, documented and managed.

The position contributes to the organization's cybersecurity and operational resilience objectives in alignment with ISO/IEC 27001, NIST Cybersecurity Framework (NIST CSF), NIST SP 800-series guidance and ITIL practices.

Job Responsibilities

1. UAM / PAM & Access Governance

• Administer and support UAM/PAM processes, ensuring least-privilege, segregation of duties and approved access controls.
• Review and manage user, privileged, administrative and service accounts throughout their lifecycle.
• Monitor privileged access and identify unauthorized or anomalous activities.
• Generate, coordinate and submit periodic User Access Reviews (UAR) for management and audit sign-off.
• Ensure timely access provisioning, modification and revocation, including role changes and employee departures.
• Maintain access approvals, review evidence and audit-ready documentation; escalate exceptions and overdue actions.

2. Graylog Administration & Log Management

• Administer, maintain and optimize the Graylog centralized log management platform, including availability, performance, capacity, storage and retention.
• Manage log sources, inputs, collectors, streams, pipelines, extractors, parsing rules, dashboards and alerts.
• Configure and maintain log parsing, normalization and real-time security alerting/use cases.
• Troubleshoot log ingestion, parsing, indexing and connectivity issues.
• Ensure critical infrastructure, network, security, application, cloud and database logs are collected and retained according to security requirements.

3. System Onboarding & Security Monitoring

• Manage onboarding of servers, network devices, security platforms, applications, databases and cloud systems into Graylog.
• Coordinate with system owners to define logging requirements, forwarding methods, retention and security events.
• Validate log connectivity, data quality and monitoring coverage after onboarding.
• Maintain an accurate log-source/system inventory and identify gaps against the security monitoring baseline.
• Perform day-to-day security monitoring, alert triage and analysis across infrastructure, network, cloud and applications.
• Identify suspicious or abnormal activities, assess risk and escalate potential security incidents in accordance with incident response procedures.
• Support investigation, containment, remediation and post-incident activities.

4. Security Incident, Problem & Change Management

• Manage security monitoring and logging incidents in accordance with ITIL-aligned Incident Management processes.
• Support investigation, root-cause analysis and Problem Management for recurring security or logging issues.
• Ensure changes to Graylog, monitoring rules, integrations and security configurations follow approved Change Management procedures.
• Maintain accurate incident records, SOPs, knowledge articles, system diagrams and operational documentation.
• Participate in security drills, incident simulations and operational readiness activities.

5. Security Compliance, Audit & Risk

• Support internal and external audits covering cybersecurity, UAM/PAM, logging, monitoring and infrastructure security.
• Prepare and provide audit evidence, access records, logs, configurations, reports and other supporting documentation.
• Track security audit findings, remediation actions and outstanding control gaps through closure.
• Ensure security operations align with ISO/IEC 27001, NIST, internal security policies and applicable regulatory requirements.
• Support continuous improvement of security controls, procedures and monitoring capabilities.

6. Stakeholder & Technical Collaboration

• Work closely with Cybersecurity, Network, Infrastructure, Cloud, Database, Application, DevOps, HR, Risk, Compliance and Audit teams.
• Coordinate with system owners to resolve logging, access control and security monitoring gaps.
• Provide security monitoring and logging requirements for new systems, projects, migrations and technology implementations.
• Support security assessments, vulnerability remediation and infrastructure security-hardening activities where required.
• Liaise with technology vendors and external security service providers as required.

7. Reporting & Management Information

• Prepare regular SOC, security monitoring, UAM/PAM and compliance reports.
• Report security alerts, incidents, log-source availability, onboarding status, access review completion, monitoring gaps and outstanding risks.
• Maintain dashboards and KPIs providing management visibility of security performance and security posture.
• Provide inputs for management, risk committee, audit and cybersecurity governance reporting.

Job Requirements

• Bachelor’s degree in IT, Computer Science, Cybersecurity, CompTIA Security+/CySA+
• Certified SOC Analyst (CSA)
• 2+ years working in a SOC (Security Operation Center), IT security, or compliance role.
• Hands-on experience with SIEM or log management tools (especially Graylog, ELK, or Splunk)
• Basic understanding of cloud computing concepts
• Good understanding of Active Directory, Azure AD/Entra ID, RBAC (Role-Based Access Control), and PAM concepts
• Basic scripting knowledge
• Understanding of basic networking fundamentals
• Basic understanding of monitoring and logging concepts