Cygnify
Senior Incident Response Specialist, Cyber Security-Malaysia
Kuala Lumpur, Kuala Lumpur, Malaysia · On-site · FullTime
Apply on the employer’s site ↗See how well you match this job
You apply directly with the employer. ROLIVA does not submit applications from this page and is not the employer.
About the role
Description from the employer’s posting. Check the employer’s page for the current version.
- EmployerCygnify
- LocationKuala Lumpur, Kuala Lumpur, Malaysia
- Work styleOn-site
- Employment typeFullTime
- Employer posted
Role Mission
The Senior Analyst - Cyber Security Incident Response is responsible for monitoring, detecting, and analyzing cybersecurity incidents through the Security Operations Centre (SOC) platform. The role supports the end-to-end incident lifecycle — including triage, investigation, containment, and closure — ensuring timely response to security events and maintaining cyber resilience. This role acts as the Level 2 (L2) Incident Responder, bridging SOC analysts and Incident Response management by performing deep technical analysis and coordinating with internal teams for resolution.
Accountabilities:
Perform end-to-end incident triage and investigation of security alerts escalated from L1 SOC analysts.
Ensure timely incident analysis, containment, and escalation aligned with MTTD and MTTR goals.
Support the SIEM platform (Elastic Stack) by fine-tuning existing rules and suggesting new detections.
Show full description
Conduct log analysis and correlation across multiple data sources (network, endpoint, and cloud).
Create and maintain incident documentation, reports, and lessons learned.
Support incident response playbook execution during containment and recovery phases.
Collaborate with IT, network, and application teams for incident remediation and root cause analysis.
Provide insights for use case improvements and participate in use case validation and testing.
Escalate confirmed incidents to CSIRT / Assistant Manager - Incident Response for further action.
Participate in post-incident reviews, contributing to process and detection improvements.
Monitor alerts generated from the SOC/SIEM and perform initial to intermediate-level investigations.
Review and validate security events from multiple log sources and identify legitimate threats.
Perform deep-dive investigations for incidents involving malware, phishing, insider threats, and cloud breaches.
Assist in detection rule creation and tuning under the guidance of senior incident responders.
Use frameworks like MITRE ATT&CK for mapping and improving detection quality.
Conduct threat hunting using Elastic Stack and related tools.
Collaborate with MSSP, CSIRT, and IT infrastructure teams to ensure timely incident handling.
Support incident response reporting, evidence collection, and documentation for compliance and audit.
Contribute to automation opportunities in detection and response workflows.
Participate in training sessions, simulations, and tabletop exercises to enhance readiness.
Responsible for the log source onboarding and managing the continuous logs availability on the SIEM platform.
Requirements
Monitor alerts generated from the SOC/SIEM and perform initial to intermediate-level investigations.
Review and validate security events from multiple log sources and identify legitimate threats.
Perform deep-dive investigations for incidents involving malware, phishing, insider threats, and cloud breaches.
Assist in detection rule creation and tuning under the guidance of senior incident responders.
Use frameworks like MITRE ATT&CK for mapping and improving detection quality.
Conduct threat hunting using Elastic Stack and related tools.
Collaborate with MSSP, CSIRT, and IT infrastructure teams to ensure timely incident handling.
Support incident response reporting, evidence collection, and documentation for compliance and audit.
Contribute to automation opportunities in detection and response workflows.
Participate in training sessions, simulations, and tabletop exercises to enhance readiness.
Responsible for the log source onboarding and managing the continuous logs availability on the SIEM platform.
#LI-KI1
Check your resume against this job Free, no sign-up. Nothing you paste is stored.
Staying safe while you apply
- Never pay to apply, interview or accept an offer. ROLIVA never asks you for payment to apply to a job.
- Apply only through the official “Apply on the employer’s site” button, on the employer’s own site, and check that a recruiter’s email uses that employer’s own domain rather than a free email address.
- Be cautious of an offer made with no real interview, or pressure to decide quickly or share financial details early.
Does something look wrong with this listing? Use “Report broken link” in the role details, or read ROLIVA’s full job-safety guidance ↗.
Preparing for this role with ROLIVA
- Check the fit.
Compare the requirements with the experience you have confirmed, including gaps.
- Prepare honestly.
Build interview stories and application drafts from your own evidence.
- Keep track.
Save the role and record your own application status and follow-ups.
At a glance
- Work styleOn-site
- Employment typeFullTime
- SenioritySenior
- Employer posted
- Added to ROLIVA
- Last checked
Explore similar roles
Similar jobs
Cygnify
Product Engineer – Cybersecurity Architect – Product & Innovation
Singapore, Singapore, Singapore