Blue Team Incident Response Lead

FIRMUS; Kuala Lumpur; On-site; MYR 180,000 - 240,000; Full time

Job summary

FIRMUS in Kuala Lumpur seeks a Blue Team Lead to manage and develop the Blue Team, driving end-to-end incident response, compromise assessments, and threat management to safeguard clients’ digital assets and strengthen cyber resilience.

You will serve as the primary point of contact during high-severity incidents, ensuring rapid containment, thorough remediation, and clear communication with executives and stakeholders. Strong DFIR, EDR, SIEM, and cloud security tooling experience preferred.

Qualifications

• Bachelor degree or equivalent in CS/IT/cybersecurity.
• Strong hands-on expertise across the full incident response lifecycle including forensic principles.

Responsibilities

• End-to-End Incident Response Leadership: Lead high‑severity security incidents from detection through recovery, including triage, containment, eradication, stakeholder coordination, and post‑incident reporting.
• Stakeholder & Executive Engagement: Act as the primary point of contact during incident response engagements, communicating incident scope, impact, and mitigation strategies clearly.
• Incident Response & Recovery Execution: Direct and oversee incident response and recovery across endpoint, network, and cloud environments.
• Digital Forensics & Root Cause Analysis: Lead investigations by analysing logs, memory, and artefacts to determine initial access vectors and root cause.
• Proactive Threat Detection & Hunting: Lead intelligence-led threat hunting and compromise assessments to identify hidden threats and inform remediation plans.
• Strategy, Playbooks & Maturity Development: Develop and enhance incident response playbooks and detection logic aligned with MITRE ATT&CK framework.

Skills

Incident response leadership

Stakeholder communication

Analytical thinking

Team leadership

Education

Bachelor Degree in Computer Science, Information Technology, Cybersecurity or equivalent

Tools

DFIR tooling

EDR

SIEM

Cloud security tooling

Job description

FIRMUS in Kuala Lumpur seeks a Blue Team Lead to manage and develop the Blue Team, driving end-to-end incident response, compromise assessments, and threat management to safeguard clients’ digital assets and strengthen cyber resilience.

You will serve as the primary point of contact during high-severity incidents, ensuring rapid containment, thorough remediation, and clear communication with executives and stakeholders. Strong DFIR, EDR, SIEM, and cloud security tooling experience preferred.