全职 Devops & PCI DSS Infrastructure Engineer 工作, 薪水 up to MYR 6,000, Pan Fareast Resources Selangor 公司招聘中 - Ricebowl

Experience: 3–5 years of experience in DevOps, Linux System Administration, or Cloud Infrastructure engineering.

DigitalOcean Expertise: Hands-on experience managing production workloads on DigitalOcean (Droplets, VPCs, Cloud Firewalls, Load Balancers, and Spaces).

PCI DSS Knowledge: Proven experience maintaining server infrastructure in a PCI DSS compliant environment (familiarity with PCI DSS v4.0 is highly preferred).

Automation & IaC: Strong proficiency with Terraform (specifically the DigitalOcean provider) and configuration management tools like Ansible.

Linux & Networking: Deep knowledge of Linux hardening (Ubuntu/Debian/RHEL), TCP/IP networking, VPNs, SSL/TLS management, and Web Application Firewalls (e.g., Cloudflare WAF).

Access & Secret Management: Experience enforcing Multi-Factor Authentication (MFA), Role-Based Access Control (RBAC), and secure secret storage (e.g., HashiCorp Vault).

Container Orchestration: Experience securing DigitalOcean Kubernetes (DOKS) clusters and container registries in regulated environments.

Security Tooling: Familiarity with open-source security and compliance stacks such as Wazuh, Fail2ban, OpenSCAP, or Nessus.

Certifications: Relevant certifications such as PCIP (Payment Card Industry Professional), CISSP, CISA, or Linux Foundation Certified System Administrator (LFCS)

DigitalOcean Infrastructure Management: Architect, deploy, and maintain Linux-based Droplets, Load Balancers, Spaces, and Managed Databases using Infrastructure as Code (Terraform and Ansible).

Network Segmentation & VPC Security: Configure and isolate the Cardholder Data Environment (CDE) using DigitalOcean Virtual Private Clouds (VPCs), Cloud Firewalls, and strict ingress/egress rules.

PCI DSS v4.0 Compliance: Implement, monitor, and enforce technical PCI DSS controls across all in-scope servers, containers, and payment processing workflows.

System Hardening & Patching: Apply CIS benchmarks to Linux Droplets, manage SSH key access and bastion hosts, and execute timely OS and software patching to meet strict PCI SLA deadlines.

Logging, Monitoring & FIM: Implement File Integrity Monitoring (FIM), centralized log collection, and alerting (e.g., Wazuh, OSSEC, or ELK/Datadog) to detect unauthorized changes or suspicious traffic.

Vulnerability Management: Run regular internal vulnerability scans, coordinate Approved Scanning Vendor (ASV) external scans, and remediate findings promptly.

Audit Readiness: Maintain accurate network architecture diagrams, Cardholder Data flow maps, and compliance evidence, including DigitalOcean's Attestation of Compliance (AOC), for annual audits.