Senior Incident Response Specialist

Starhub Ltd; Petaling Jaya; On-site; MYR 60,000 - 90,000; Full time

Job summary

StarHub Ltd in Malaysia seeks a Senior Incident Response Specialist to monitor, detect and analyse cybersecurity incidents within the SOC. You will bridge L2 analysts and management, performing deep technical analysis and coordinating with internal teams for incident resolution.

Responsibilities include end-to-end triage, investigation, containment and post-incident reviews, with emphasis on SIEM tuning, log correlation and use-case development. Strong communication is essential.

Qualifications

• 2–3 years of experience in a SOC or Incident Response (L2) environment.
• Intermediate hands-on experience with SIEM platforms (Elastic Stack preferred).
• Exposure to incident triage, malware analysis, phishing response, and log correlation.
• Familiarity with security tools such as EDR, NDR, and threat intel platforms.
• Certifications such as CEH, CompTIA Security+, GCIA, or Elastic Certified Analyst preferred.

Responsibilities

• Monitor alerts from SOC/SIEM and perform initial to intermediate investigations.
• Validate security events and identify genuine threats across multiple sources.
• Perform deep-dive investigations for malware, phishing, insider threats, and cloud breaches.
• Assist in detection rule creation and tuning under guidance of senior responders.
• Map detections using MITRE ATT&CK and conduct threat hunting with Elastic Stack.
• Collaborate with MSSP, CSIRT, IT infra to ensure timely incident handling.

Skills

SOC

Incident Response

SIEM

Log analysis

MITRE ATT&CK

Threat hunting

Documentation

Communication

Tools

Elastic Stack

EDR

NDR

Job description

Select how often (in days) to receive an alert:

Date: 27 Sept 2026

Location: Petaling Jaya, MY

Job Title: Senior Incident Response Specialist, Cyber Security

Role Mission: The Senior Analyst – Cyber Security Incident Response is responsible for monitoring, detecting, and analysing cybersecurity incidents through the Security Operations Centre (SOC) platform. The role supports the end-to-end incident lifecycle — including triage, investigation, containment, and closure — ensuring timely response to security events and maintaining StarHub’s cyber resilience. This role acts as the Level 2 (L2) Incident Responder, bridging SOC analysts and Incident Response management by performing deep technical analysis and coordinating with internal teams for resolution.

Accountabilities:

• Perform end-to-end incident triage and investigation of security alerts escalated from L1 SOC analysts.
• Ensure timely incident analysis, containment, and escalation aligned with MTTD and MTTR goals.
• Support the SIEM platform (Elastic Stack) by fine-tuning existing rules and suggesting new detections.
• Conduct log analysis and correlation across multiple data sources (network, endpoint, and cloud).
• Create and maintain incident documentation, reports, and lessons learned.
• Support incident response playbook execution during containment and recovery phases.
• Collaborate with IT, network, and application teams for incident remediation and root cause analysis.
• Provide insights for use case improvements and participate in use case validation and testing.
• Escalate confirmed incidents to CSIRT / Assistant Manager – Incident Response for further action.
• Participate in post-incident reviews, contributing to process and detection improvements.

Responsibilities:

• Monitor alerts generated from the SOC/SIEM and perform initial to intermediate-level investigations.
• Review and validate security events from multiple log sources and identify legitimate threats.
• Perform deep-dive investigations for incidents involving malware, phishing, insider threats, and cloud breaches.
• Assist in detection rule creation and tuning under the guidance of senior incident responders.
• Use frameworks like MITRE ATT&CK for mapping and improving detection quality.
• Conduct threat hunting using Elastic Stack and related tools.
• Collaborate with MSSP, CSIRT, and IT infrastructure teams to ensure timely incident handling.
• Support incident response reporting, evidence collection, and documentation for compliance and audit.
• Contribute to automation opportunities in detection and response workflows.
• Participate in training sessions, simulations, and tabletop exercises to enhance readiness .
• Responsible for the log source onboarding and managing the continuous logs availability on the SIEM platform.

Areas of Impact:

• Scope: Operational role responsible for incident triage, analysis, and escalation within enterprise-wide SOC operations. Involves intermediate-level SIEM management (Elastic Stack) focusing on log analysis and event correlation. Covers on-premises, cloud, and hybrid infrastructure environments.
• Decision Rights: Authority to validate and expand confirmed incidents to the CSIRT or Assistant Manager. Can recommend new use cases and detection rules, subject to review and approval. Authorized to perform containment actions under predefined playbooks or guidance.
• Stakeholders: ISO / CSIRT Team, SOC L1 Team, IT Infrastructure / Cloud / Application Teams, Risk & Compliance Team, External MSSP / Security Vendors.
• Resources: Elastic SIEM (Elasticsearch, Logstash, Kibana, Beats), EDR / NDR tools, Threat Intel Feeds, SOAR platforms, and support from SOC Analysts, CSIRT, and IT Operations teams.

Ideal Track Record:

• 2–3 years of experience in a SOC or Incident Response (L2) environment.
• Intermediate hands-on experience with SIEM platforms (Elastic Stack preferred).
• Exposure to incident triage, malware analysis, phishing response, and log correlation.
• Strong understanding of use case creation and MITRE ATT&CK framework mapping.
• Demonstrated ability to analyze complex alerts and distinguish false positives from true incidents.
• Familiarity with security tools such as EDR, NDR, Cyber security tools and threat intelligence platforms.
• Good communication and documentation skills for stakeholder updates.
• Certifications such as CEH, CompTIA Security+, GCIA, or Elastic Certified Analyst preferred.