Cybersecurity Lead

NEXT Ventures; Kuala Lumpur; On-site; MYR 300,000 - 540,000; Full time

Job summary

NEXT Ventures in Kuala Lumpur seeks a Cybersecurity Lead to serve as the senior technical authority for threat detection, incident response, and risk reduction. You will guide the security analysis team and collaborate with Engineering, DevOps, IT, Compliance, and leadership to ensure controls support business resilience.

You will drive detection engineering, threat hunting, and incident response, while coordinating with product and engineering to embed security into design and remediation.

Qualifications

• 7+ years in cybersecurity with leadership/mentoring experience
• Experience handling high-severity incidents and guiding analysts
• Strong knowledge of attack frameworks, IR lifecycle and security controls
• Familiarity with MITRE ATT&CK, NIST CSF, CIS Controls and ISO 27001 (where applicable)
• Industry certifications (e.g., CISSP/GCIH/GCFA/OSCP/CISM) are a plus

Responsibilities

• Lead threat detection, incident response and risk reduction for high-severity incidents.
• Define and improve investigation methodologies, IR workflows and evidence handling.
• Lead root cause analysis for major incidents and ensure preventive actions are tracked.
• Drive detection engineering: close gaps, tune rules, define use cases and telemetry quality.
• Map security practices to frameworks and provide evidence for audit readiness.
• Report trends and metrics to leadership in business language.
• Run SOC operations: monitoring, triage, investigation, escalation and reporting.
• Coach analysts through case reviews and structured learning plans.

Skills

Threat detection

Incident response

Threat hunting

Detection engineering

MITRE ATT&CK

Cloud security

Automation

Forensics

Leadership

Job description

NEXT Ventures is a global fintech group operating FundedNext (prop trading) and FNmarkets (CFD brokerage), with teams across Malaysia, Bangladesh, Sri Lanka, Cyprus, and Dubai. We build trading products that traders rely on every day, and security is central to keeping that trust.

Your Role in Our Mission

As Cybersecurity Lead, you are our senior technical authority for threat detection, incident response, and risk reduction. You lead the security analysis team, guide it through high-severity incidents, and work with Engineering, DevOps, IT, Compliance, and leadership so that our controls support business resilience.

How You’ll Make an Impact

Security Operations & Incident Response

Lead analysis and response for high-severity incidents: account and endpoint compromise, cloud events, data exposure, and application-layer attacks.

Define and improve investigation methodologies, IR workflows, and evidence-handling practices.

Lead root cause analysis for major and recurring incidents, with preventive actions clearly owned and tracked.

Act as the senior escalation point for analysts, engineers, IT, and DevOps.

Detection & Threat Hunting

Drive detection engineering: close coverage gaps, tune rules, define use cases, and improve telemetry quality.

Run hypothesis-driven threat hunts based on attacker TTPs, threat intelligence, and our specific exposure.

Prioritize vulnerabilities by exploitability, asset criticality, business impact, exposure, and compensating controls, not CVSS alone.

Map security practices to relevant frameworks and provide technical evidence for audit readiness.

Report trends, incident metrics, and control gaps to leadership in clear business language.

Run day-to-day security analysis operations: monitoring, triage, investigation, escalation, and reporting.

Manage workload, priorities, and investigation queues; direct analysts during active incidents and high-volume periods.

Review investigation quality, documentation, RCA outputs, and stakeholder updates.

Coach and upskill analysts through case reviews, feedback, and structured learning plans.

Track SOC metrics: alert volume, triage quality, escalation timelines, and vulnerability follow-up.

Process, Tooling & Roadmap

Build and maintain playbooks, escalation models, and investigation standards.

Evaluate tools and automation for enrichment, triage, reporting, and response.

Partner with Engineering, DevOps, IT, and Product to embed security learnings into design and remediation.

Identify maturity gaps and recommend roadmap priorities for the security function.

What You Bring

Experience

7+ years in cybersecurity, including experience leading or mentoring analysts and handling high-severity incidents.

Technical skills

Advanced analysis of attacks across identity, endpoint, network, cloud, and application layers.

Hands-on incident response, including containment and remediation planning.

Detection strategy and engineering: use-case definition, telemetry improvement, false-positive reduction.

Hypothesis-driven threat hunting aligned to MITRE ATT&CK.

Working knowledge of digital forensics: artifacts, evidence preservation, timeline analysis, compromise assessment.

Cloud and identity security: IAM risks, MFA, privileged access, suspicious authentication patterns.

Automation of enrichment, triage, reporting, and response workflows.

Frameworks

Strong working knowledge: MITRE ATT&CK, NIST CSF, CIS Controls, Incident Response Lifecycle.

Working knowledge: ISO 27001, OWASP Top 10, PCI DSS / GDPR (where applicable).

Leadership

Sets clear priorities and quality standards; guides teams under pressure.

Builds trust with IT, Engineering, DevOps, Compliance, and business teams.

Translates technical risk into executive-ready insights.

X-Factor

Industry certifications (e.g., CISSP, GCIH, GCFA, OSCP, CISM, or cloud security certifications) [confirm list].

Experience in fintech, trading, or other regulated, high-availability environments.

A record of building detection or automation capabilities that measurably cut response time.

A culture-builder mindset: ownership, analytical discipline, and continuous learning.