Cyber Security Engineer

RHB Bank Berhad; Malaysia; On-site; MYR 90,000 - 150,000; Full time

Job summary

RHB Bank Berhad seeks a senior Cyber Threat specialist to join the Cyber Threat team as Tier 3 SME and mentor to the SOC team. The role emphasizes continuous detection, analysis, investigation, response, and mitigation of advanced threats within the bank's IT infrastructure using a proven cyberthreat model such as MITRE ATT&CK.

Ideal candidates have 4–5 years in information security, 1–2 years supporting IR/investigations, and strong skills in SIEM (Splunk, Imperva), threat hunting, and

Qualifications

• 4–5 years information security experience
• 1–2 years supporting incident response and/or investigations
• Experience reviewing logs for anomalous activity indicating the presence of a threat
• Strong ability to translate threats into business risk and reporting

Responsibilities

• Maintain SIEM solution including health checks and patching
• Ensure events/logs from devices are forwarded to SIEM completely and accurately
• Produce monthly SIEM health and activity reports
• Hunt threats using industry methodologies (MITRE ATT&CK/Cyber Kill Chain)
• Analyze host/network traffic, IDS/IPS/DLP events, and firewall logs
• Develop and onboard use cases to SOC for 24x7 monitoring

Skills

Threat hunting

MITRE ATT&CK

Scripting (Python/ PowerShell)

Incident response

Technical writing

Communication

Tools

Splunk

Imperva

Job description

To be part of Cyber Threat team, tier 3 SME and mentor to the SOC team. This role required continuous detection, analysis, investigation, response, and mitigation of advanced threats before they affected the bank's IT infrastructure via a proven and documented cyberthreat model, e.g., Mitre Attack Framework Preferred level of Experience (by years/function/industry): 4 - 5 years of information security experience 1 - 2 years supporting incident response and/or investigations Experience reviewing and assessing logs for anomalous activity indicating the presence of a threat Knowledge and ability to identify threat actor attack methods and track their developments Experience using Threat Model e.g. Cyber Kill Chain & Mitre ATT&CK Extensive experience conveying complex information in simple, succinct explanations Exceptional attention to detail Other skills required (if applicable): Strong technical writing skills Extensive experience with analytical tradecraft Thorough understanding of cybersecurity principles Ability to work independently and build relationships Efficient research methodologies Ability to relate & convert technical threats with business risks Strong proficiency with scripting and programming languages (e. g. Python, PowerShell, Java, NodeJS, Perl, etc). Strong communication & writing skills for reporting and analysis on cumulative findings

KEY RESPONSIBLITIES

• Solution Maintaining of SIEM solution including Splunk, Imperva and etc. (Task including compliance to patch and obsolescence framework requirement)
• Ensure events / logs from all relevant devices are sending to SIEM solution in a complete and accurate manner
• To produce monthly SIEM system health report (completeness and accurate)
• Hunting Perform threat hunting through industry accepted methodologies including Hypothesis Driven investigation, IOC driven Investigation or Machin Leaning Investigation
• Analyze host, network traffic, IDS/IPS/DLP events, packet capture, firewall logs and other relevant solutions
• Provide forensic analysis of network packet captures, DNS, proxy, Netflow, malware, host-based security and application logs, as well as logs from various types of security sensors
• Identify gaps in IT infrastructure by mimicking an attacker s behaviors and responses
• Perform offensive validation on identified TTP’s
• Detection & Response Continuously develop SIEM use cases based on Mitre Attack framework based on threat landscape
• To onboard all use cases to Security Operation Center for 24 x 7 monitoring and timely response
• Continuously onboard new IOC to threat prevention solution to ensure known threat are prevented at all time
• Continuously improve processes for use across multiple detection sets for more efficient Security Operations
• Develop dashboards and reports to identify potential threats, suspicious/anomalous activity, malware, etc.
• Assist in the design, evaluation, and implementation of new security technologies

A mantra for our clients, customers, partners and every member of the RHB family. Yes, you. Our employees are one of the reasons we are here today. Dynamic, forward-thinking and progressive, there is a reason why we are an award-winning financial institution. Join us today and be a part of a winning family. At RHB, we take pride in our people and our teams. Great relationships built on trust, a 'leading it right' environment, challenging assignments and a culture of excellence are the pillars to the dynamic and diversified workplace we call home. As we grow towards realising our aspirations, we promise a workplace built on the five pillars – RHB Cares; RHB Leads; RHB Inspires; RHB Progresses; and RHB Rewards.