Senior Incident Commander & Lead IR Response

Ensign InfoSecurity; Petaling Jaya; On-site; MYR 180,000 - 300,000; Full time

Job summary

Ensign InfoSecurity in Malaysia seeks a senior, hands-on incident response leader to command the response from declaration to closure and guide a team of analysts and forensic specialists when needed. You will direct containment, coordinate with client platform owners, and ensure changes go through the client’s process, while keeping executives informed.

This role requires 8+ years in security operations, major incidents, hands-on investigations, and the ability to brief CISOs and regulators

Qualifications

• Proven command of real incidents from declaration to closure.
• Experience with major incidents: ransomware, BEC or cloud takeover.
• Hands-on investigation across endpoints, identity, email, cloud and network.
• Ability to brief CISOs/executives under pressure and write regulator-ready reports.
• Knowledge of incident reporting under BNM RMiT, MAS TRM, GDPR or PDPA.
• Willing to join on-call rotation and travel to client sites on short notice.

Responsibilities

• Own the incident response from the moment it is declared to the moment the last follow-up action is closed.
• Direct containment using client-approved actions and obtain explicit approvals for anything beyond them.
• Lead or carry out investigations across endpoints, identity, email, cloud and network.
• Preserve evidence to a standard that holds up to regulators, insurers and lawyers.
• Bring in external forensic support when an incident outgrows the team.
• Keep stakeholders informed with fixed cadence and format: facts, assumptions, decisions, issues, actions.

Skills

Incident response leadership

SOC operations

Incident command

Communication with executives

On-call readiness

Education

GCIH

GCFA

GNFA

GCFR

Tools

CrowdStrike

Cortex XDR

SentinelOne

Microsoft Defender

Splunk

Microsoft Sentinel

QRadar

Cortex XSIAM

Job description

Ensign InfoSecurity in Malaysia seeks a senior, hands-on incident response leader to command the response from declaration to closure and guide a team of analysts and forensic specialists when needed. You will direct containment, coordinate with client platform owners, and ensure changes go through the client’s process, while keeping executives informed.

This role requires 8+ years in security operations, major incidents, hands-on investigations, and the ability to brief CISOs and regulators