Senior DFIR Lead – Forensics & Incident Response

rgare; Kuala Lumpur; On-site; MYR 150,000 - 230,000; Full time

Job summary

RGA is seeking a senior incident response professional to lead complex cyber investigations, strengthen enterprise resilience, and guide security teams through critical incidents across global environments.

You will combine hands-on DFIR expertise with strategic advisory capabilities, stakeholder engagement, and security program leadership, engaging executives and technical responders in high-pressure situations.

Qualifications

• 5+ years in incident response or related cybersecurity roles.
• Experience leading major cyber incidents incl. ransomware and cloud compromise.
• Strong digital forensics using standard tools.
• Experience with Splunk, Defender, CrowdStrike, ServiceNow SIR.
• Knowledge of network protocols, log analytics, threat hunting.

Responsibilities

• Lead enterprise incident response and cyber crisis engagements from detection through recovery.
• Direct investigations across Windows, Linux, macOS, Microsoft 365, AWS, Azure, and hybrid environments.
• Perform advanced threat hunting and assessments using SIEM/EDR/forensics.
• Develop containment, eradication, remediation strategies aligned to risk.
• Produce executive briefings and post-incident reviews.
• Partner with legal, compliance, privacy, audit, and external stakeholders.
• Drive adoption of AI-assisted workflows to improve speed and efficiency.
• Support the 24/7 on-call rotation.

Skills

Incident response

DFIR

Security operations

Threat hunting

Digital forensics

Executive communication

Education

Bachelor's degree in Cybersecurity or related field

Tools

Splunk

Microsoft Defender

CrowdStrike Falcon

ServiceNow SIR

Cloud security technologies

Job description

RGA is seeking a senior incident response professional to lead complex cyber investigations, strengthen enterprise resilience, and guide security teams through critical incidents across global environments.

You will combine hands-on DFIR expertise with strategic advisory capabilities, stakeholder engagement, and security program leadership, engaging executives and technical responders in high-pressure situations.