Senior Incident Responder

Ensign InfoSecurity; Petaling Jaya; On-site; MYR 180,000 - 300,000; Full time

Job summary

Ensign InfoSecurity in Malaysia seeks a senior, hands-on incident response leader to command the response from declaration to closure and guide a team of analysts and forensic specialists when needed. You will direct containment, coordinate with client platform owners, and ensure changes go through the client’s process, while keeping executives informed.

This role requires 8+ years in security operations, major incidents, hands-on investigations, and the ability to brief CISOs and regulators

Qualifications

• Proven command of real incidents from declaration to closure.
• Experience with major incidents: ransomware, BEC or cloud takeover.
• Hands-on investigation across endpoints, identity, email, cloud and network.
• Ability to brief CISOs/executives under pressure and write regulator-ready reports.
• Knowledge of incident reporting under BNM RMiT, MAS TRM, GDPR or PDPA.
• Willing to join on-call rotation and travel to client sites on short notice.

Responsibilities

• Own the incident response from the moment it is declared to the moment the last follow-up action is closed.
• Direct containment using client-approved actions and obtain explicit approvals for anything beyond them.
• Lead or carry out investigations across endpoints, identity, email, cloud and network.
• Preserve evidence to a standard that holds up to regulators, insurers and lawyers.
• Bring in external forensic support when an incident outgrows the team.
• Keep stakeholders informed with fixed cadence and format: facts, assumptions, decisions, issues, actions.

Skills

Incident response leadership

SOC operations

Incident command

Communication with executives

On-call readiness

Education

GCIH

GCFA

GNFA

GCFR

Tools

CrowdStrike

Cortex XDR

SentinelOne

Microsoft Defender

Splunk

Microsoft Sentinel

QRadar

Cortex XSIAM

Job description

You will command the serious security incidents our SOC handles for clients, from the first call to the final report. When an alert becomes an incident, you take charge: you set priorities, direct containment within the authority the client has given us, keep the client informed, and make sure nothing falls between teams. Ensign InfoSecurity runs managed SOC and SOC augmentation services for banks, insurers, telcos and large enterprises across the region. Our analysts detect and triage. You take over when something is real and stay with it until it is contained, recovered, reported and learned from.

This is a senior, hands-on role. On smaller incidents, you will investigate yourself. On major ones, you lead a team of analysts and forensic specialists and keep your hands off the keyboard so you can see the whole picture.

Key Responsibilities

You own the response to an incident from the moment it is declared to the moment the last follow-up action is closed.

Take command

• Declare the incident, agree the severity with the client and open the incident record.
• Set up the response: who investigates, who contains, who keeps the client updated, who keeps the log.
• Run the response in short cycles: what do we know, what does it mean, what do we decide, what do we do next. Reset priorities as the facts change.

Contain and recover

• Direct containment using the actions the client has already approved, and get explicit approval for anything beyond them.
• Work with the client's platform owners so changes go through their change process, not around it.
• Decide when the threat is removed and systems are safe to return to normal, and record the evidence behind that call.
• Lead or carry out the investigation across endpoints, identity, email, cloud and network.
• Preserve evidence to a standard that holds up to regulators, insurers and lawyers.
• Bring in external forensic support when an incident outgrows the team, and manage that work.

Keep stakeholders informed

• Send client updates on a fixed rhythm and in a fixed format: facts, assumptions, decisions, issues, actions.
• Brief client CISOs and executives in plain business terms: what happened, what it means for them, what we need from them.
• Track regulatory notification deadlines (BNM RMiT, MAS TRM, GDPR, PDPA) so the client has what it needs to notify on time. The client notifies; you make sure it can.

Close and learn

• Deliver the post-incident report and root cause analysis within planned business days.
• Turn findings into fixes: new detections, playbook changes, client control gaps
• Track each one to closure.
• Run tabletop exercises with clients so playbooks are tested before a real incident tests them.

Build the bench

• Own the incident playbooks, call trees and severity definitions for the accounts you cover.
• Coach SOC analysts in incident handling and develop deputy incident commanders.
• Act as the senior escalation point for SOC shift leads

Requirements

We are hiring for proven command of real incidents, not exercise experience alone.

• 8 years or more in security operations or incident response, with at least 4 years leading incident response.
• Has commanded at least 3 major incidents from declaration to closure, such as ransomware, business email compromise or a cloud account takeover, and can walk us through the decisions made and why.
• Hands-on investigation across endpoint detection tools (CrowdStrike, Cortex XDR, SentinelOne or Microsoft Defender), identity (Entra ID, Okta, Active Directory), email and cloud (AWS, Azure or Google Cloud).
• Can query at least one SIEM confidently: Splunk, Microsoft Sentinel, QRadar, Cortex XSIAM, Google SecOps or CrowdStrike LogScale.
• Evidence handling and chain of custody, plus disk and memory forensics.
• Can brief a CISO or executive in plain language under pressure, and write an incident report a regulator would accept.
• Working knowledge of incident reporting under at least one of BNM RMiT, MAS TRM, GDPR or PDPA.
• At least one hands-on incident response certification: GCIH, GCFA, GNFA, GCFR or equivalent.
• Willing to join an on-call rotation and travel to client sites at short notice.

Good to have :

• Experience on the service provider or consulting side, running incidents for several clients at once.
• Malware reverse engineering (GREM or equivalent).
• Formal incident command or crisis management training.