រាយការណ៍ជោគជ័យ

1. UAM / PAM & Access Governance

• Administer and support UAM/PAM processes, ensuring least-privilege, segregation of duties and approved access controls.
• Review and manage user, privileged, administrative and service accounts throughout their lifecycle.
• Monitor privileged access and identify unauthorized or anomalous activities.
• Generate, coordinate and submit periodic User Access Reviews (UAR) for management and audit sign-off.
• Ensure timely access provisioning, modification and revocation, including role changes and employee departures.
• Maintain access approvals, review evidence and audit-ready documentation; escalate exceptions and overdue actions.

2. Graylog Administration & Log Management

• Administer, maintain and optimize the Graylog centralized log management platform, including availability, performance, capacity, storage and retention.
• Manage log sources, inputs, collectors, streams, pipelines, extractors, parsing rules, dashboards and alerts.
• Configure and maintain log parsing, normalization and real-time security alerting/use cases.
• Troubleshoot log ingestion, parsing, indexing and connectivity issues.
• Ensure critical infrastructure, network, security, application, cloud and database logs are collected and retained according to security requirements.

3. System Onboarding & Security Monitoring

• Manage onboarding of servers, network devices, security platforms, applications, databases and cloud systems into Graylog.
• Coordinate with system owners to define logging requirements, forwarding methods, retention and security events.
• Validate log connectivity, data quality and monitoring coverage after onboarding.
• Maintain an accurate log-source/system inventory and identify gaps against the security monitoring baseline.
• Perform day-to-day security monitoring, alert triage and analysis across infrastructure, network, cloud and applications.
• Identify suspicious or abnormal activities, assess risk and escalate potential security incidents in accordance with incident response procedures.
• Support investigation, containment, remediation and post-incident activities.

4. Security Incident, Problem & Change Management

• Manage security monitoring and logging incidents in accordance with ITIL-aligned Incident Management processes.
• Support investigation, root-cause analysis and Problem Management for recurring security or logging issues.
• Ensure changes to Graylog, monitoring rules, integrations and security configurations follow approved Change Management procedures.
• Maintain accurate incident records, SOPs, knowledge articles, system diagrams and operational documentation.
• Participate in security drills, incident simulations and operational readiness activities.

5. Security Compliance, Audit & Risk

• Support internal and external audits covering cybersecurity, UAM/PAM, logging, monitoring and infrastructure security.
• Prepare and provide audit evidence, access records, logs, configurations, reports and other supporting documentation.
• Track security audit findings, remediation actions and outstanding control gaps through closure.
• Ensure security operations align with ISO/IEC 27001, NIST, internal security policies and applicable regulatory requirements.
• Support continuous improvement of security controls, procedures and monitoring capabilities.

6. Stakeholder & Technical Collaboration

• Work closely with Cybersecurity, Network, Infrastructure, Cloud, Database, Application, DevOps, HR, Risk, Compliance and Audit teams.
• Coordinate with system owners to resolve logging, access control and security monitoring gaps.
• Provide security monitoring and logging requirements for new systems, projects, migrations and technology implementations.
• Support security assessments, vulnerability remediation and infrastructure security-hardening activities where required.
• Liaise with technology vendors and external security service providers as required.

7. Reporting & Management Information

• Prepare regular SOC, security monitoring, UAM/PAM and compliance reports.
• Report security alerts, incidents, log-source availability, onboarding status, access review completion, monitoring gaps and outstanding risks.
• Maintain dashboards and KPIs providing management visibility of security performance and security posture.
• Provide inputs for management, risk committee, audit and cybersecurity governance reporting.

• Bachelor’s degree in IT, Computer Science, Cybersecurity, CompTIA Security+/CySA+
• Certified SOC Analyst (CSA)
• 2+ years working in a SOC (Security Operation Center), IT security, or compliance role.
• Hands-on experience with SIEM or log management tools (especially Graylog, ELK, or Splunk)
• Basic understanding of cloud computing concepts
• Good understanding of Active Directory, Azure AD/Entra ID, RBAC (Role-Based Access Control), and PAM concepts
• Basic scripting knowledge
• Understanding of basic networking fundamentals
• Basic understanding of monitoring and logging concepts