Kerja Sepenuh Masa, Assistant Vice President - Cyber Threat Detection Specialist di MNRB Group Federal Territory - Maukerja

About MNRB

Malaysian National Reinsurance Berhad, the country's national reinsurer was set up in 1972 to reduce the outflow of reinsurance premiums overseas. The Company commenced operations on 19 February 1973.

In 2005, as a result of a restructuring exercise within the MNRB Group, the Company's reinsurance license, business and assets were transferred to its subsidiary company, Malaysian Reinsurance Berhad.

JOB PURPOSE

The job’s purpose is to proactively identify, investigate and respond to potential cyber threats,

malicious activities and indicators of compromise that may not be detected through conventional

automated security monitoring.

The role is also responsible for conducting threat hunting activities across endpoints, networks,

identities, applications and other technology environments; analyzing security telemetry and

threat intelligence; developing and improving detection capabilities; and supporting the

organization’s overall cyber resilience and incident response capabilities.

The role contributes to the Group's Identify, Protect, Detect, Respond and Recover cyber

resilience capabilities and supports compliance with applicable regulatory and cybersecurity

requirements, including Bank Negara Malaysia's Risk Management in Technology (RMiT).

KEY RESPONSIBILITIES

Threat Hunting

• Conduct proactive and hypothesis-driven threat hunting activities across the Group's IT environment.
• Search for indicators of compromise (IOCs), indicators of attack (IOAs) and suspicious behaviours that may bypass existing security controls.
• Analyse endpoint, network, identity, application, cloud and security logs to identify anomalous activities.
• Investigate suspicious activities involving:

-Privileged accounts

-Authentication and access patterns

-Lateral movement

-Command-and-control activities

-Malware and ransomware

-Persistence mechanisms

-Credential theft

-Data exfiltration

-Unauthorised remote access

• Conduct targeted hunts based on current threat intelligence, emerging threats and relevant adversary tactics, techniques and procedures (TTPs).
• Perform retrospective searches following significant security incidents or newly identified threats.

Security Monitoring and Detection

• Work closely with the SOC to investigate suspicious alerts and determine whether further threat hunting is required.
• Review and analyse security telemetry from SIEM, EDR/XDR, NDR, firewall, identity, DLP and other security platforms.
• Develop, tune and improve threat detection rules, queries and use cases.
• Identify gaps in security monitoring and recommend additional detection mechanisms.
• Reduce false positives while improving detection coverage for significant cyber threats.
• Map relevant detection capabilities to recognised attack frameworks such as MITRE ATT&CK.

Vulnerability and Exposure Monitoring

• Correlate threat intelligence with known vulnerabilities and technology assets.
• Identify vulnerabilities that may present heightened risk based on active exploitation or observed threat activity.
• Support prioritisation of vulnerabilities based on threat context and business criticality.
• Work with Infrastructure, Application and IT Security teams to validate remediation of significant security exposures.

Cybersecurity Improvement

• Identify weaknesses and gaps in current threat detection and hunting capabilities.
• Recommend improvements to SIEM, EDR/XDR, NDR, SOC and other security monitoring technologies.
• Develop and maintain threat hunting playbooks and procedures.
• Conduct periodic assessments of detection coverage against relevant threat scenarios.
• Support cybersecurity exercises, red-team activities, penetration tests and cyber drills where required.
• Maintain documentation of threat hunting activities, findings, actions and outcomes.Governance, Risk and Compliance
• Maintain appropriate records of threat hunting activities, findings and remediation actions.
• Provide cybersecurity threat and detection metrics for management reporting.
• Support the Head of IT Security in reporting significant threats, vulnerabilities and security incidents to the relevant governance committees.
• Ensure threat hunting activities are aligned with the Group's Cyber Resilience Framework, cybersecurity policies and applicable regulatory requirements.
• Support RMiT compliance assessments and provide evidence relating to threat detection, monitoring and response capabilities.
• Work with Cyber Risk Management to communicate material cyber threats and associated risks.

QUALIFICATION & EXPERIENCE

Academic

• Bachelor's Degree in Cybersecurity, Information Security, Computer Science, Information Technology or a related discipline.

Professional

• Certification in relevant network security or technical security will be an added advantage.

Experience

• Preferably 3 – 7 years of experience in cybersecurity, SOC, security monitoring, incident response, threat intelligence or threat hunting.
• Experience in a financial services, insurance/reinsurance or other regulated environment would be advantageous.
• Practical experience with SIEM and EDR/XDR platforms is preferred.
• Experience in investigating cybersecurity incidents and analysing security logs.
• Experience with MITRE ATT&CK and threat hunting methodologies is preferred.

CRITICAL COMPETENCIES REQUIRED

Technical Skills

• Excellent knowledge in threat hunting, threat intelligence, security monitoring, security analysis and detection engineering.
• Excellent experience in incident triage and correlation of event through SIEM technologies (Arcsight, Splunk, Logrhythm, IBM QRadar or any other solutions)
• Knowledge in Unix environments, Networking and Microsoft OS.

Behavioural Competencies

• Strong analytical and investigative skills
• Strong attention to detail
• Curiosity and proactive mindset
• Ability to think like an adversary
• Strong problem-solving capability
• Ability to work under pressure during security incidents
• Good communication and report-writing skills
• Ability to collaborate with SOC, Infrastructure, Application, Risk and Business teams
• Strong sense of confidentiality and professional integrity
• Continuous learning and awareness of emerging cyber threat