ROLE OVERVIEW
This role is responsible for supporting company’s cybersecurity resilience through continuous monitoring, threat detection, threat hunting, incident investigation and response activities. The role supports operation and continuous improvement of CTOS security monitoring and incident response capabilities by leveraging SOC, EDR/MDR, threat intelligence, and security analytics capabilities. This position will work closely with internal technology teams, service providers, and business stakeholders.
KEY RESPONSIBILITIES:
1. Detection & Response Operations
- Support the operation and continuous improvement of cybersecurity monitoring capabilities, including Security Operations Centre (SOC), Endpoint Detection and Response (EDR), Managed Detection and Response (MDR), Security Information and Event Management (SIEM), and related security monitoring technologies.
- Review and validate detection rules, alert logic, correlation rules, and behavioural analytics to improve detection coverage and reduce false positives.
- Collaborate with infrastructure, application, cloud, and identity teams to improve logging, telemetry, visibility, and security monitoring coverage across the enterprise environment.
- Coordinate periodic testing and validation of detection capabilities against known attack techniques and adversary behaviours.
- Coordinate and manage the end-to-end incident response lifecycle, including detection, analysis, containment, eradication, recovery, post-incident review, and lessons learned.
- Coordinate cybersecurity incident investigations with internal stakeholders and external service providers to ensure effective resolution of security incidents.
- Conduct root cause analysis and identify corrective actions to prevent recurrence of security incidents.
- Support digital forensic investigations, evidence preservation activities, and incident documentation as required.
- Maintain and continuously improve incident response procedures, escalation workflows, and cyber incident playbooks.
- Support cyber resilience initiatives by validating incident response readiness through tabletop exercises, simulations, and response testing activities.
2. Threat Hunting & Threat Intelligence
- Perform proactive threat hunting activities to identify malicious activities, anomalous behaviour, indicators of compromise (IOC), and indicators of attack (IOA) that may evade traditional detection mechanisms.
- Develop detection use cases and response strategies based on emerging threats, attack trends, and threat intelligence findings.
- Monitor cyber threat trends, exploit campaigns, ransomware activity, credential compromise, and other threat developments impacting the financial services and technology sectors.
3. Security Protection Technologies
- Support the implementation, administration, and operational effectiveness of security controls and security technologies, including CrowdStrike Falcon, Netskope, SIEM platforms, and other enterprise security technologies.
- Monitor the health, effectiveness, and coverage of deployed security controls and coordinate improvements where required.
- Support endpoint security hardening, endpoint protection, detection coverage enhancement, and security control optimisation initiatives.
4. Governance & Stakeholder Management
- Support the implementation, monitoring, and enforcement of cybersecurity policies, standards, procedures, and incident response requirements across the organisation.
- Support preparation of cybersecurity operational reports, incident summaries, threat intelligence briefings, dashboards, committee papers, and management updates
JOB REQUIREMENTS:
- Bachelor’s Degree in information security, computer science, technology, or related discipline.
- Professional certifications such as CISM, CRISC, CEH, OSCP, CompTIA, or equivalent.
- 3 – 7 years of experience in Information Security or Cybersecurity domains such as SOC operations, threat hunting, incident response, forensic investigation, or a related field.
- Familiarity with industry standards and regulatory frameworks such as CIS controls, BNM RMiT, CSA’s Cloud Control Matrix, ISO 27001 or similar standards.
- Strong understanding of cybersecurity monitoring, incident detection, incident response, threat hunting, and security operations processes.
- Hands-on experience investigating security incidents.
- Familiarity with SIEM, EDR, MDR, SOAR, and enterprise monitoring technologies such as CrowdStrike Falcon.
- Good understanding of MITRE ATT&CK framework.
- Ability to analyze logs, alerts, indicators of compromise, endpoint telemetry, and threat intelligence data to identify and investigate security threats.
- Ability to assess emerging cyber threats, including those related to cloud, AI and automation.
- Strong stakeholder management and cross-functional coordination skills.
- Effective verbal and written communication skills, with the ability to engage both technical and non-technical audiences.
EMPLOYMENT DETAILS:
- Salary: Negotiable depending on experience and skillset
- Job Type: Permanent
- Location: Persiaran Barat, Seksyen 52 Petaling Jaya, 46200 Petaling Jaya, Selangor
- Working Hours: Monday to Friday, 40 hours per week
Pay: RM9,000.00 - RM15,000.00 per month
Benefits:
- Health insurance
- Opportunities for promotion
- Professional development
Work Location: In person