Security Operations Lead: Threat Detection & Response

DKSH; Kuala Lumpur; On-site; MYR 180,000 - 300,000; Full time

Job summary

DKSH in Kuala Lumpur is seeking a Security Operations Center (SOC) Lead to drive detection, response, and continuous improvement of security monitoring across regional environments. You will lead alert triage, incident handling, and reporting to protect DKSH's digital assets and operations.

You will oversee incident response playbooks, coordinate with IT teams, and mentor analysts. Proficiency with Microsoft Defender XDR, Sentinel, and KQL is essential, as is strong leadership and communication.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS or engineering; professional certifications preferred.
• 7+ years of cybersecurity experience with exposure to SOC operations, incident response, threat hunting, or leadership.
• Deep expertise in SOC operations, incident response, threat hunting, and alert tuning.
• Hands-on investigation using KQL within Microsoft Sentinel, Defender XDR, and Defender for Endpoint.
• Strong understanding of Windows, Linux, Active Directory, Entra ID, endpoint telemetry, network security, and malware behavior.
• Ability to develop incident timelines, evidence summaries, containment recommendations, and executive updates.
• Knowledge of MITRE ATT&CK and SIEM/EDR/XDR workflows.

Responsibilities

• Lead day-to-day SOC operations including alert triage, incident queue management, analyst workload balancing, quality review, escalation, and reporting.
• Develop and maintain SOC processes, runbooks, incident response playbooks, escalation matrices, and evidence handling practices.
• Drive proactive threat hunting using Defender XDR, Sentinel, EDR, SIEM, identity logs, endpoint telemetry, network logs, cloud activity logs.
• Ensure monitoring use cases align to enterprise threats, critical assets, privileged activity, identity risks, application exposure, and business priorities.
• Own SOC reporting including alert volume, true positive rate, incident trends, remediation follow-up.
• Lead post-incident reviews and ensure lessons learned are converted into improvements.
• Mentor SOC analysts during investigations, major incidents, and escalations.
• Coordinate cross-functional incident responses with IT teams to ensure containment and resolution.
• Communicate incident status and business impact to technical teams and senior management.
• Foster a resilience-focused SOC culture.

Skills

SOC operations

Incident response

Threat hunting

Detection engineering

Security leadership

Executive communication

Incident timelines

Education

Bachelor's degree in Cybersecurity/IT/CS/Engineering

CISSP

GIAC GCIH

GIAC GCIA

GIAC GCFA

SC-200

AZ-500

Tools

KQL

Microsoft Sentinel

Microsoft Defender XDR

Defender for Endpoint

SIEM

Endpoint telemetry

Job description

DKSH in Kuala Lumpur is seeking a Security Operations Center (SOC) Lead to drive detection, response, and continuous improvement of security monitoring across regional environments. You will lead alert triage, incident handling, and reporting to protect DKSH's digital assets and operations.

You will oversee incident response playbooks, coordinate with IT teams, and mentor analysts. Proficiency with Microsoft Defender XDR, Sentinel, and KQL is essential, as is strong leadership and communication.