Blue Team Incident Response Lead

FIRMUS; Kuala Lumpur; Presencial; MYR 180.000 - 300.000; Jornada completa

Descripción de la vacante

FIRMUS seeks a Blue Team Lead in Kuala Lumpur to manage and develop the Blue Team, driving incident response, compromise assessments, and threat management to safeguard digital assets and resilience. You will serve as the primary contact during high-severity incidents, ensuring rapid containment, thorough remediation, and clear communication with stakeholders.

The role requires hands-on expertise across the full incident response lifecycle, DFIR, EDR, SIEM, and cloud security tooling, plus

Formación

• Bachelor degree in CS/IT/Cybersecurity or equivalent.
• Deep hands-on expertise across the full incident response lifecycle.
• Platform-agnostic DFIR, EDR, IR, SIEM, and cloud security tooling experience.

Responsabilidades

• Lead end-to-end incident response and containment efforts.
• Coordinate with executives to communicate incident scope and impact.
• Oversee response and recovery across endpoints, networks, and cloud.
• Lead digital forensics to identify initial access and root cause.
• Perform proactive threat hunting and apply findings to remediation.
• Develop and enhance incident response playbooks aligned with MITRE ATT&CK.

Conocimientos

Incident response

Forensics principles

DFIR

EDR

SIEM

Cloud security

Threat hunting

MITRE ATT&CK

Network analysis

Stakeholder communication

Educación

BSc in CS/IT/Cybersecurity

Herramientas

EDR tooling

Cloud security tooling

Forensic tooling

Network monitoring tools

Descripción del empleo

FIRMUS seeks a Blue Team Lead in Kuala Lumpur to manage and develop the Blue Team, driving incident response, compromise assessments, and threat management to safeguard digital assets and resilience. You will serve as the primary contact during high-severity incidents, ensuring rapid containment, thorough remediation, and clear communication with stakeholders.

The role requires hands-on expertise across the full incident response lifecycle, DFIR, EDR, SIEM, and cloud security tooling, plus