Platform Operations Engineer - #1615

Key Responsibilities:

Patching Frequency and Patch Lifecycle

The Contractor shall monitor Oracle Security Advisories, Oracle Critical Patch Update (CPU) quarterly releases and monthly Critical Security Patch Updates (CSPUs) throughout the contract period.

Unless otherwise instructed, the Contractor shall perform patch assessment and support patch deployment activities for Oracle CPU releases.

We reserves the right to defer, accelerate or combine patch cycles based on operational requirements, vulnerability severity, audit requirements or Oracle recommendations.

Oracle Middleware Day‑2 Patching and Operations

Covers:

· Oracle HTTP Server (OHS)

· Oracle WebLogic Server (includes Oracle Application Development Framework)

· Oracle Forms and Reports

Activities:

· Pre-Patch assessment (compatibility, dependencies, conflicts). Review and submit the CPU Assessment Risk Matrix (per Annex C template) for Fusion Middleware based on the published list of Common Vulnerabilities and Exposures (CVEs) on Oracle Website and obtain approval prior to commencing patch deployment.

· Schedule and Plan. Monitor, initiate, schedule and plan the patching activity for the environment whilst ensuring that IM8-aligned timeline is complied.

· Preparation. Binary staging and preparation

· Backup and rollback. Perform Oracle Home backups and ensure rollback readiness before execution.

· Patch Deployment. Ensure patching with no service downtime for PROD and UAT; Patch deployment.

· Post-Patch validation and support. Services are restarted and post-patch validation to confirm availability and functionality for stabilization support including issue resolution support

Oracle Database Day-2 Patching and Operations

Covers: Oracle Database Enterprise Server with Data Guard (active/passive)

Activities:

· Pre-Patch assessment (compatibility, dependencies, conflicts). Review, submit the CPU Assessment Risk Matrix (per Annex C template) for Database based on the published list of CVEs on Oracle Website and obtain approval prior to commencing patch deployment.

· Schedule and Plan. Monitor, initiate, schedule and plan the patching activity for the environment whilst ensuring that IM8-aligned timeline is complied.

· Preparation. Stage database patch binaries and prepare the patching/staging environments.

· Backup and rollback. Perform Oracle Home Backups and worked to ensure full database backups and confirm recovery/rollback readiness. Prepare rollback/recovery plans prior to database patching, manage switchover and downtime activities. Restore database services if services are not started after patch. To follow up with Software principle on the resolution.

· Patch Deployment. Perform patching on the passive database node first, followed by switchover and patching of the new passive node in line with the active/passive Data Guard architecture.

· Post-Patch validation and support. Restart services where applicable and validate database health, connectivity, validating data guard health, redo transport, database synchronization, listener and ensure successful database operations before handover. That includes stabilization support and not limited to issue resolution support.

Oracle Enterprise Manager (OEM) Day-2 Patching and Operations

Covers: Oracle Enterprise Manager 13c

Activities:

· Pre-Patch assessment (compatibility, dependencies, conflicts). Review, submit the CPU Assessment Risk Matrix (per Annex C template) for Oracle Enterprise Manager based on the published list of CVEs on Oracle Website and obtain NYP approval prior to commencing patch deployment.

· Schedule and Plan. Monitor, initiate, schedule and plan the patching activity for the environment whilst ensuring that IM8-aligned timeline is complied.

· Preparation. Stage OEM patch binaries and prepares the patching environments.

· Backup and rollback. Perform Oracle Home Backups, Repository, confirm recovery/rollback readiness. Prepare rollback/recovery plans prior to database patching. Restore database services if services are not started after patch. To follow up with Software principle on the resolution.

· Patch Deployment. Perform patching for OEM Components (OEM Management Servers, Repository database and monitoring agents)

· Post-Patch validation and support. Restart services where applicable and validate monitoring / agent communications. Provide stabilization support and not limited to issue resolution support.

Pro*C Day‑2 Patching and Operations

Covers: Oracle Database Enterprise Server

Activities:

· Pre-Patch assessment (compatibility, dependencies, conflicts). This should be included as part of the CPU Assessment Risk Matrix for Database.

· Schedule and Plan. Monitor, initiate, schedule and plan the patching activity for the environment whilst ensuring that IM8-aligned timeline is complied.

· Preparation. Stage patch binaries and prepare the patching/staging environments.

· Backup and rollback. Perform Oracle Home Backups, confirm recovery/rollback readiness. Prepare rollback/recovery plans prior to patching.

· Patch Deployment. Perform patching on the Oracle Software.

· Post-Patch validation and support. Validate database connectivity, recompilation where required, validate application integration / runtime behaviour and to ensure the batch programs are running. Provide stabilization support and not limited to issue resolution support.

Vulnerability Assessment (VA) Remediation Support

The activities shall include:

a. Review and analyses vulnerability assessment findings from quarterly VA scans, security reviews and audit findings upon request.

b. Validate applicability of identified vulnerabilities to PROD, UAT, and DEV environments.

c. Determine remediation options, including patching, configuration hardening, compensating controls, or risk acceptance recommendations.

d. Implement remediation actions upon approval.

e. Perform validation testing after remediation.

f. Provide evidence of remediation for audit and compliance purposes.

g. Support re-scanning activities and review scan results to confirm successful remediation.

h. Assist in investigating false positives arising from vulnerability scans.

i. Provide technical recommendations for vulnerabilities that cannot be immediately remediate.

Oracle Support Coordination (SR management)

The Contractor shall work on Oracle technical support coordination services where patch-related issues arise including but not limited to:

a. Raise Oracle Service Requests (SRs)

b. Managing SR lifecycles from initiation to closure.

c. Submit logs, diagnostics and trace files to Oracle Support upon approval.

d. Coordination with Oracle Support engineers on issue resolution

e. Track resolution progress and provide status updates

f. Implement Oracle recommended fixes upon approval

g. Escalation of critical incidents to Oracle Support where required

Cross‑Environment Operational Support

The activities shall include:

a. Assess PROD/UAT/DEV environments via Privileged Identity and Access Management (PIAM) tool in accordance with access governance requirements, define patch sequencing and schedules, and coordinate activities with stakeholders.

b. Prepare rollback and recovery procedures, execute database switchover and downtime activities where required, and execute Production database patching during scheduled maintenance windows, which are generally conducted on Saturdays to minimize business impact.

c. Support UAT/PROD web server auto‑scaling when required.

d. Support implementation activities conducted during approved maintenance windows, including after-office hours, weekends and public holidays where required for PRODUCTION environments.

e. Conduct comprehensive post‑patch validation covering application, infrastructure and monitoring checks.

Documentation and Governance Support

The Contractor shall:

a. Provide patch-cycle documentation: execution records, issues/remediation, and completion/status reporting.

b. Support formal sign‑off for each patch cycle before subsequent cycles commence.

c. Ensure all activities comply with operational, security, and governance requirements.

Service Levels (SLA)

CPU Assessment Risk Matrix Submission

Upon receiving notification of a CPU release, the Contractor shall submit the CPU Risk Assessment Risk Matrix within five (5) working days unless Oracle vulnerability information is unavailable at the point of release. In that case, NYP should be informed and Contractor shall request for extension.

Post-Patch Stabilization Support

The Contractor shall provide stabilization support for up to three (3) working days following completion of PROD environment patch deployment in each patch cycle.

The stabilization support shall include:

· Investigation of patch-related issues

· Service restoration activities

· Oracle SR management

· Defect troubleshooting

· Application connectivity troubleshooting

· Middleware and database health monitoring

· Recommendation and implementation of corrective actions