Senior IT Security Engineer
Summary
Runs proactive security operations at PTT Digital: owns the end-to-end vulnerability management lifecycle and delivers services like penetration testing, attack surface management, and cloud security posture management, then reports risk posture to enterprise customers. Centered on risk-based prioritization (CVSS, EPSS) and frameworks like NIST CSF and ISO 27001.
About the role
Perform and oversee proactive security operations covering vulnerability management, penetration testing, and attack surface management services. Manage the end-to-end Vulnerability Management lifecycle: discovery, categorization, prioritization, remediation tracking, and reporting.
Key responsibilities
Deliver proactive security services such as vulnerability assessment, web application scanning, penetration testing, attack surface management, security rating, security control validation, cloud security posture management, phishing simulation, cyber drill, and security awareness programs
Analyze vulnerability findings, perform risk-based prioritization, and provide remediation recommendations to infrastructure, application, and security operations teams
Work with other teams to share vulnerability information, improve detection capabilities, and ensure services meet operational needs
Monitor service SLA/KPI such as remediation rate, scan coverage, and customer risk posture
Prepare and present security posture dashboards and reports to customers on a monthly/quarterly basis
Provide guidance and knowledge sharing to junior team members
Evaluate new tools, automation, and best practices to continuously improve security services
About you
Bachelor's Degree or higher in Computer Engineering, Computer Science, IT Security or any related fields
At least 7 years of experience in cybersecurity, with 3 years or above in Vulnerability Management, Penetration Testing, or Offensive Security
Hands-on experience with vulnerability assessment tools, attack surface management platforms, breach and attack simulation tools, cloud security posture management, or security rating services
Good knowledge in risk-based prioritization (CVSS, EPSS, asset criticality) and security frameworks (NIST CSF, ISO 27001)
Good working as a team and can communicate in both technical and business part
Ability to prioritize and manage multiple services and projects in parallel
Ability to work under pressure and good communication with enterprise customers
Strong command of English (Required TOEIC score at least 550)