The posting
Key Responsibilities
Cyber Incident Response & Management
- Lead the end-to-end management of cyber security incidents, ensuring appropriate prioritization, investigation, containment, eradication, and recovery activities
- Act as the primary escalation point for high-severity security incidents and coordinate incident response activities across OpCos and stakeholders
- Direct cyber incident bridge calls and crisis management activities during major security incidents
- Ensure incident response activities are executed in accordance with established SLAs, regulatory requirements, and organizational policies
- Develop and maintain incident response playbooks, runbooks, escalation matrices, and standard operating procedures (SOPs)
- Conduct post-incident reviews, root cause analysis, lessons learned sessions, and track remediation actions
Security Monitoring & Detection Enhancement
- Provide guidance and oversight to SOC analysts and managed security service providers to improve detection accuracy, triage quality, and investigation effectiveness
- Review and validate alerts escalated from monitoring teams to ensure accurate contextualization and prioritization
- Drive continuous enhancement of security monitoring use cases, detection content, correlation rules, and threat detection frameworks
- Collaborate with Security Engineering teams to improve visibility, telemetry, and detection coverage across enterprise environments
Digital Forensics & Malware Analysis
- Lead forensic investigations involving endpoint, network, cloud, and mobile environments
- Perform or oversee digital evidence acquisition, preservation, analysis, and reporting in accordance with forensic standards
- Conduct advanced malware analysis and reverse engineering activities to determine attack methodologies, indicators of compromise (IOCs), and business impact
- Support legal, regulatory, and compliance investigations where digital forensic expertise is required
Threat Intelligence & Threat Hunting
- Analyze emerging cyber threats, vulnerabilities, adversary tactics, techniques, and procedures (TTPs) to improve defensive capabilities
- Convert threat intelligence into actionable detection rules, hunting hypotheses, and response actions
- Lead proactive threat hunting activities leveraging MITRE ATT&CK and intelligence-led methodologies
- Coordinate with internal and external intelligence sources to assess risks affecting Axiata Group and OpCos
Automation & Continuous Improvement
- Drive security orchestration, automation, and response (SOAR) initiatives to improve operational efficiency and reduce mean time to detect (MTTD) and mean time to respond (MTTR)
- Identify opportunities for process optimization, workflow automation, and operational maturity enhancements
- Evaluate emerging cyber security technologies and recommend adoption based on business and operational requirements
- Contribute to the strategic development and maturity roadmap of ACFC's incident response capabilities
Security Testing & Readiness
- Coordinate cyber security assessments, threat-led exercises, tabletop simulations, red team engagements, and breach attack simulations
- Validate detection and response capabilities against identified threats and attack scenarios
- Provide guidance and recommendations for remediation and risk reduction initiatives
- Support cyber crisis exercises and preparedness activities across the Axiata Group
Leadership & Stakeholder Management
- Provide technical leadership, coaching, and mentoring to SOC analysts and incident responders
- Engage effectively with senior management, technology teams, risk, compliance, legal, and external partners during security incidents
- Prepare executive-level incident reports, risk summaries, and operational metrics
- Foster collaboration across multicultural and geographically distributed teams
Key Performance Indicators (KPIs)
- Achievement of Incident Response SLA and KPI targets
- Reduction in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
- Timely containment and eradication of high and critical severity incidents
- Improvement in detection use case effectiveness and detection coverage
- Successful execution of threat hunting and proactive detection initiatives
- Enhancement of automation and orchestration within incident response processes
- Quality and completeness of forensic investigations and incident reports
- Completion of post-incident reviews and remediation tracking
- Stakeholder satisfaction and effective coordination during major incidents
- Contribution towards ACFC operational maturity and cyber resilience objectives
Person Specifications
Education
- Bachelor's Degree in Cyber Security, Information Security, Computer Science, Information Technology, or related discipline
- Master's degree or relevant advanced studies is an added advantage
Experience
- Minimum 8 years of experience in Cyber Security Operations, Incident Response, or Cyber Defense functions
- Minimum 5 years of hands-on experience managing cyber incidents in enterprise or regional environments
- Experience operating within a SOC, Cyber Fusion Center, CSIRT, CERT, or Incident Response environment
- Experience managing security incidents across multi-country or regional operations is highly preferred
- Experience with cloud incident response (Azure, AWS, GCP) is highly desirable
Professional Certifications (Preferred)
- GIAC Certified Incident Handler (GCIH)
- GIAC Certified Forensic Analyst (GCFA)
- GIAC Reverse Engineering Malware (GREM)
- Certified Incident Handler (EC-Council ECIH)
- Certified Ethical Hacker (CEH)
- Certified Information Systems Security Professional (CISSP)
- GIAC Certified Intrusion Analyst (GCIA)
- CrowdStrike Certified Incident Responder (CCIR)
- Microsoft Cybersecurity Architect Expert or equivalent
Technical Competencies
- Strong knowledge of incident response lifecycle, digital forensics, malware analysis, and threat hunting methodologies
- Deep understanding of MITRE ATT&CK framework, cyber kill chain, and adversary emulation techniques
- Strong knowledge of Advanced Persistent Threats (APT), ransomware, business email compromise, insider threats, and cloud-focused attacks
- Experience with: o SIEM platforms (Microsoft Sentinel, Splunk, QRadar) o EDR/XDR platforms (CrowdStrike, Microsoft Defender, Carbon Black) o SOAR platforms o Network Detection & Response (NDR) o Threat Intelligence platforms o Email Security platforms o Cloud Security technologies
- Strong understanding of: o TCP/IP networking o Network security monitoring o Firewalls, IDS/IPS o DNS, Proxy and Web Security o Endpoint Security technologies
- Experience performing log analysis, packet analysis, forensic investigations, and advanced threat investigations
- Working knowledge of scripting and automation languages such as Python, PowerShell, Bash, or KQL
- Experience in Telecom incident Response will be added advantage
- Experience in FinTech incident Response will be added advantage
Behavioral Competencies
- Strong analytical and problem-solving capabilities
- Ability to perform effectively under pressure during major cyber security incidents
- Excellent stakeholder management and communication skills
- Strong report writing and executive presentation abilities
- Ability to lead and coordinate cross-functional teams across multiple countries and cultures
- Results-oriented with a continuous improvement mindset
