Team Lead (Blue Team)

FIRMUS; Kuala Lumpur; On-site; MYR 180,000 - 300,000; Full time

Job summary

FIRMUS seeks a Blue Team Lead in Kuala Lumpur to manage and develop the Blue Team, driving incident response, compromise assessments, and threat management to safeguard digital assets and resilience. You will serve as the primary contact during high-severity incidents, ensuring rapid containment, thorough remediation, and clear communication with stakeholders.

The role requires hands-on expertise across the full incident response lifecycle, DFIR, EDR, SIEM, and cloud security tooling, plus

Qualifications

• Bachelor degree in CS/IT/Cybersecurity or equivalent.
• Deep hands-on expertise across the full incident response lifecycle.
• Platform-agnostic DFIR, EDR, IR, SIEM, and cloud security tooling experience.

Responsibilities

• Lead end-to-end incident response and containment efforts.
• Coordinate with executives to communicate incident scope and impact.
• Oversee response and recovery across endpoints, networks, and cloud.
• Lead digital forensics to identify initial access and root cause.
• Perform proactive threat hunting and apply findings to remediation.
• Develop and enhance incident response playbooks aligned with MITRE ATT&CK.

Skills

Incident response

Forensics principles

DFIR

EDR

SIEM

Cloud security

Threat hunting

MITRE ATT&CK

Network analysis

Stakeholder communication

Education

BSc in CS/IT/Cybersecurity

Tools

EDR tooling

Cloud security tooling

Forensic tooling

Network monitoring tools

Job description

The Blue Team Lead will manage and develop the Blue Team, driving end-to-end incident response, compromise assessments, and threat management to safeguard clients’ digital assets and strengthen their cybersecurity resilience. This role serves as the primary point of contact during high-severity incidents, ensuring rapid containment, thorough remediation, and clear communication with stakeholders and executives.

Key Responsibilities

• End-to-End Incident Response Leadership: Lead high-severity security incidents from detection through recovery, including triage, containment, eradication, stakeholder coordination, and post-incident reporting.
• Stakeholder & Executive Engagement: Act as the primary point of contact during incident response engagements, working closely with executive and senior leadership to communicate incident scope, impact, and mitigation strategies clearly and effectively.
• Incident Response & Recovery Execution: Direct and oversee incident response and recovery activities across endpoint, network, and cloud environments, ensuring rapid containment and thorough remediation.
• Digital Forensics & Root Cause Analysis: Lead forensic investigations by analysing logs, memory, and forensic artefacts to determine initial access vectors, root cause, and end-to-end adversary timelines.
• Proactive Threat Detection & Hunting: Lead intelligence-led threat hunting and compromise assessments across diverse infrastructures to proactively identify hidden or persistent threats and incorporate findings into incident scoping and remediation plans.
• Strategy, Playbooks & Maturity Development: Develop, maintain, and continuously enhance incident response playbooks, detection logic, and hunting queries, aligning capabilities with the MITRE ATT&CK framework and industry best practices.

Qualification

Technical & Professional Experience

• Bachelor Degree in Computer Science, Information Technology, Cybersecurity or equivalent.
• Strong hands-on expertise across the full incident response lifecycle, including forensic principles and advanced malware behaviour
• Deep, platform-agnostic experience with DFIR, EDR, IR, SIEM, and cloud security tooling, with emphasis on investigative methodology and outcomes
• Expert-level ability to analyse operating system, network (e.g. firewall, proxy), and cloud telemetry for evidence collection and incident reconstruction
• Extensive knowledge of network protocols, modern adversary Tactics, Techniques, and Procedures (TTPs), and the MITRE ATT&CK framework

Certifications (Preferred)

• GCIH, GCFA, CHFI, or equivalent advanced Incident Response / DFIR certifications
• Strong analytical and detail-oriented problem-solving skills, with the ability to balance security response with client business requirements
• Proven ability to remain calm, decisive, and effective in high-pressure, high-impact incident scenarios
• Excellent verbal and written communication skills, essential for leading teams and managing senior stakeholder communications
• Self-driven and independent leader capable of driving large-scale incident response efforts with minimal supervision