Senior Cyber Operations Engineer (SIEM/SOAR & Security Platform Engineering)

About the role

Kyndryl's Cybersecurity Engineers design, run and manage secure, reliable technology infrastructure for its customers. As a Senior Cyber Operations Engineer in Bangkok, you will support SIEM, vulnerability management and AV/EDR solutions across Managed Hosting, Private Cloud and Public Cloud environments, monitor and resolve security incidents and lead technical troubleshooting.

Key responsibilities

• Design, deploy, configure and support SIEM, vulnerability management and AV/EDR solutions across hosting, private and public cloud environments.
• Monitor, investigate and resolve complex security incidents, alerts and infrastructure issues while meeting SLAs.
• Lead root cause analysis, remediation and continuous service improvement of security processes and workflows.
• Collaborate with customers and architects to assess security requirements and implement solutions.
• Maintain technical documentation, implementation standards, operational procedures and security best practices.
• Contribute to the development, testing and rollout of new cybersecurity services and platforms.
• Provide technical leadership during escalations, support pre-sales activities and mentor team members.

Required profile

• 5+ years of hands-on cybersecurity engineering, SOC or security operations experience in enterprise or managed services environments.
• Proven experience developing detection use cases, correlation rules, automated playbooks and incident response capabilities.
• Ability to lead high-severity incident investigations, drive containment and recovery, and mentor SOC team members.
• Customer-focused, growth-minded and inclusive; a bachelor's degree in Cybersecurity, Computer Science, Information Technology or a related field is preferred.

Required skills

• Strong expertise in SIEM, SOAR, Detection Engineering, Threat Hunting, Security Automation and Cyber Operations.
• Experience with Microsoft Sentinel, Splunk, QRadar, Cortex XSOAR, Chronicle or Elastic Security.
• Incident response, digital forensics, major incident management, threat intelligence (CTI), ASM and active defense.
• Cloud security (AWS, Azure, GCP or OCI), including Zero Trust, identity security and cloud-native controls.
• Preferred: UEBA, MITRE ATT&CK, malware analysis, containerized and DevSecOps environments.