Full Time Manager, IT Security Operations - Engineering [RID-00714] Jobs, in Setel Federal Territory - Maukerja

About Setel:

The Future of Mobility

Introduced in July 2018, Setel is a mobile platform that aims to delight customers by innovating for better, inclusive mobility. Setel serves customers across Malaysia by powering one app as the constant companion to ease motorists’ journey across fueling, parking, EV charging, motor insurance, road tax, auto assistance, general purchases, and more across an ecosystem of PETRONAS petrol stations, retail partners, and online merchants.

Role Purpose:

Reporting directly to the CTO, the Manager, IT Security Operations & Engineering serves as the primary operational lead for 1st Line of Defense (1LoD) cybersecurity. This role directly manages and coordinates technical security engineering teams across Endpoint & Data Protection, IAM & Network Operations, and Cloud/DevSecOps Engineering.

The Manager ensures all systems are built securely by design, operational controls are actively enforced daily, and technical security incidents are contained swiftly, while executing rapid remediation on VAPT findings provided by 2nd Line Cyber Defense.

In this role you will:

• 1st Line Team Leadership: Directly manage, mentor, and oversee engineers across the three operational pillars (Endpoint & Data Security, IAM & Network Security Ops, Cloud & DevSecOps Security Engineering).
• CTO Strategic Alignment: Translate business goals and CTO technical objectives into actionable security engineering roadmaps, tooling budgets, and delivery schedules without slowing down product engineering.
• Operational SLA Governance: Establish and enforce KPIs/SLAs for system patching, EDR agent deployment rates, access de-provisioning speeds, CI/CD pipeline security gates, and initial incident containment times.
• Endpoint & Data Protection: Drive operational deployment, agent health, and policy execution of EDR, DLP, email security gateways, and workstation patching across all enterprise assets.
• IAM & Network Access: Execute day-to-day zero-trust access enforcement, user lifecycle provisioning/deprovisioning, PAM credential vaulting, and network firewall rule implementation.
• Cloud & DevSecOps: Build security-as-code (IaC), integrate automated pre-production security gates (SAST/DAST/SCA) directly into CI/CD pipelines, and secure cloud API gateways.
• VAPT Remediation & Patch Ownership: Serve as the primary remediation owner for all external and 2nd Line VAPT findings. Manage technical tickets, assign engineering tasks, enforce fix SLAs, and verify hotfixes before requesting 2nd Line re-testing.
• Joint Incident Response & Technical Containment: Execute immediate operational response to security alerts (host isolation, key revocation, session terminations). Hand off initial triage and telemetry data to 2nd Line Cyber Defense for deep threat hunting and post-incident root-cause analysis.
• Audit & Evidence Generation: Maintain automated logging and provide technical proof to internal/external auditors and 2nd Line teams regarding access controls, patching levels, and yencryption standards.
  
  

You're a great fit if you have:

• 6–9+ years leading multi-disciplinary IT security engineering teams directly under technical leadership (CTO / VP of Engineering).
• Strategic Alignment: Balances CTO speed-to-market and tooling budgets with robust control enforcement across Endpoint, IAM/Network, and DevSecOps.
• Endpoint & Data: EDR/XDR health, host isolation, endpoint DLP, and automated OS/third-party patch management.
• IAM & Network: Zero-trust SSO, PAM vaulting and just-in-time access, cloud WAF/NGFW, mTLS, and network segmentation.
• Cloud & DevSecOps: Infrastructure-as-Code (IaC) security templates, automated CI/CD pipeline scanning gates (SAST/SCA), and API gateway security.
• Recommended certifications: CISSP, CISM, CCSP, Certified DevSecOps Expert (CDE), or GIAC Cloud Security Automation (GCSA).
• Executing critical vulnerability patching SLAs ($\le$ 72 hours for internet-facing systems).
• Enforcing mandatory MFA, zero-trust access, and PAM across privileged and remote accounts.
• Streaming tamper-proof infrastructure and application logs to 2LoD SIEM for mandatory 3-year retention.
• Operating automated pipeline security gates and cloud perimeter controls to fulfill PCI DSS v4.0 (Requirements 1, 6, 8, 10).
• VAPT Remediation Lead: Serves as primary 1LoD owner for 2LoD VAPT findings, managing ticket assignments and patch remediation SLAs.
• Technical Compensating Controls: Defends technical exception requests to 2LoD GRC with active, validated compensating controls.
• Incident Hand-off: Executes initial 1LoD containment (host isolation, key revocation) before handing telemetry to 2LoD SOC for root-cause analysis.
• Evidence Pipelines: Automates evidence collection for access reviews, system hardening, and patching for 2LoD Compliance Assurance and external auditors.
  
  

What Makes Working With Us Awesome

• Our people and culture: You will get to work with awesome and friendly colleagues to whom you can expect to collaborate well to deliver your work. Empowerment is given and you will get a lot of opportunities for peer-learning.
• Availability of tools and applications: You will be provided with different tools to facilitate your work. Automate your work whenever possible so that you can focus on delivering impact for your role.
• Development focused: Your learning and growth matters most for us. We are people centric and always ready to help our people to define what they want to make an impact on and craft their learning plan accordingly.
  
  

Cool Perks/Benefits

• Hybrid working arrangement; Flexible working hours.
• Relax and unwind at the leisure area with video games, board games, books, and more.
• Wear your favourite jeans, or any cool OOTD so that you can work comfortably (in style).
• Coffee, tea, or snacks are available for consumption at the pantry. Because you’ll be happier with a full tummy.
• A healthy body leads to a brilliant mind. Let’s get moving with the inter-company sports team.
• There will be workshops, talent shows, sport activities, and other events for sharing and bonding.
  
  

Personal Data Protection

Setel Ventures Sdn Bhd (“Setel”, “we”, “our” “us”) is committed to protecting and respecting your privacy. This Setel privacy statement (“Privacy Statement”) explains what personal data we collect about you, when and why we collect it, how we use it, the conditions under which we may disclose it to others, your rights to your personal data, and how we keep it secure. This Privacy Statement covers both our online and offline collection activities, including personal data that we collect through online platforms such as websites, applications, third-party social networks or our online and physical events, or through other third parties that we work with. Please read this carefully to understand our views and practices regarding your personal data.