Job Openings Incident Response Lead

About the job Incident Response Lead

Key Responsibilities

Cyber Incident Response & Management

  • Lead the end-to-end management of cyber security incidents, ensuring appropriate prioritization, investigation, containment, eradication, and recovery activities
  • Act as the primary escalation point for high-severity security incidents and coordinate incident response activities across OpCos and stakeholders 
  • Direct cyber incident bridge calls and crisis management activities during major security incidents
  • Ensure incident response activities are executed in accordance with established SLAs, regulatory requirements, and organizational policies
  • Develop and maintain incident response playbooks, runbooks, escalation matrices, and standard operating procedures (SOPs)
  • Conduct post-incident reviews, root cause analysis, lessons learned sessions, and track remediation actions

Security Monitoring & Detection Enhancement

  • Provide guidance and oversight to SOC analysts and managed security service providers to improve detection accuracy, triage quality, and investigation effectiveness
  • Review and validate alerts escalated from monitoring teams to ensure accurate contextualization and prioritization
  • Drive continuous enhancement of security monitoring use cases, detection content, correlation rules, and threat detection frameworks
  • Collaborate with Security Engineering teams to improve visibility, telemetry, and detection coverage across enterprise environments

Digital Forensics & Malware Analysis

  • Lead forensic investigations involving endpoint, network, cloud, and mobile environments
  • Perform or oversee digital evidence acquisition, preservation, analysis, and reporting in accordance with forensic standards
  • Conduct advanced malware analysis and reverse engineering activities to determine attack methodologies, indicators of compromise (IOCs), and business impact
  • Support legal, regulatory, and compliance investigations where digital forensic expertise is required

Threat Intelligence & Threat Hunting

  • Analyze emerging cyber threats, vulnerabilities, adversary tactics, techniques, and procedures (TTPs) to improve defensive capabilities
  • Convert threat intelligence into actionable detection rules, hunting hypotheses, and response actions
  • Lead proactive threat hunting activities leveraging MITRE ATT&CK and intelligence-led methodologies
  • Coordinate with internal and external intelligence sources to assess risks affecting Axiata Group and OpCos

Automation & Continuous Improvement

  • Drive security orchestration, automation, and response (SOAR) initiatives to improve operational efficiency and reduce mean time to detect (MTTD) and mean time to respond (MTTR)
  • Identify opportunities for process optimization, workflow automation, and operational maturity enhancements
  • Evaluate emerging cyber security technologies and recommend adoption based on business and operational requirements
  • Contribute to the strategic development and maturity roadmap of ACFC's incident response capabilities

Security Testing & Readiness

  • Coordinate cyber security assessments, threat-led exercises, tabletop simulations, red team engagements, and breach attack simulations
  • Validate detection and response capabilities against identified threats and attack scenarios
  • Provide guidance and recommendations for remediation and risk reduction initiatives
  • Support cyber crisis exercises and preparedness activities across the Axiata Group

Leadership & Stakeholder Management

  • Provide technical leadership, coaching, and mentoring to SOC analysts and incident responders
  • Engage effectively with senior management, technology teams, risk, compliance, legal, and external partners during security incidents
  • Prepare executive-level incident reports, risk summaries, and operational metrics
  • Foster collaboration across multicultural and geographically distributed teams

Key Performance Indicators (KPIs)

  • Achievement of Incident Response SLA and KPI targets
  • Reduction in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
  • Timely containment and eradication of high and critical severity incidents
  • Improvement in detection use case effectiveness and detection coverage
  • Successful execution of threat hunting and proactive detection initiatives
  • Enhancement of automation and orchestration within incident response processes
  • Quality and completeness of forensic investigations and incident reports
  • Completion of post-incident reviews and remediation tracking
  • Stakeholder satisfaction and effective coordination during major incidents
  • Contribution towards ACFC operational maturity and cyber resilience objectives

Person Specifications

Education

  • Bachelor's Degree in Cyber Security, Information Security, Computer Science, Information Technology, or related discipline
  • Master's degree or relevant advanced studies is an added advantage

Experience

  • Minimum 8 years of experience in Cyber Security Operations, Incident Response, or Cyber Defense functions
  • Minimum 5 years of hands-on experience managing cyber incidents in enterprise or regional environments
  • Experience operating within a SOC, Cyber Fusion Center, CSIRT, CERT, or Incident Response environment
  • Experience managing security incidents across multi-country or regional operations is highly preferred
  • Experience with cloud incident response (Azure, AWS, GCP) is highly desirable

Professional Certifications (Preferred)

  • GIAC Certified Incident Handler (GCIH)
  • GIAC Certified Forensic Analyst (GCFA)
  • GIAC Reverse Engineering Malware (GREM)
  • Certified Incident Handler (EC-Council ECIH)
  • Certified Ethical Hacker (CEH)
  • Certified Information Systems Security Professional (CISSP)
  • GIAC Certified Intrusion Analyst (GCIA)
  • CrowdStrike Certified Incident Responder (CCIR)
  • Microsoft Cybersecurity Architect Expert or equivalent

Technical Competencies

  • Strong knowledge of incident response lifecycle, digital forensics, malware analysis, and threat hunting methodologies
  • Deep understanding of MITRE ATT&CK framework, cyber kill chain, and adversary emulation techniques
  • Strong knowledge of Advanced Persistent Threats (APT), ransomware, business email compromise, insider threats, and cloud-focused attacks
  • Experience with:
    o SIEM platforms (Microsoft Sentinel, Splunk, QRadar)
    o EDR/XDR platforms (CrowdStrike, Microsoft Defender, Carbon Black)
    o SOAR platforms
    o Network Detection & Response (NDR)
    o Threat Intelligence platforms
    o Email Security platforms
    o Cloud Security technologies
  • Strong understanding of:
    o TCP/IP networking
    o Network security monitoring
    o Firewalls, IDS/IPS
    o DNS, Proxy and Web Security
    o Endpoint Security technologies
  • Experience performing log analysis, packet analysis, forensic investigations, and advanced threat investigations
  • Working knowledge of scripting and automation languages such as Python, PowerShell, Bash, or KQL
  • Experience in Telecom incident Response will be added advantage
  • Experience in FinTech incident Response will be added advantage

Behavioral Competencies

  • Strong analytical and problem-solving capabilities
  • Ability to perform effectively under pressure during major cyber security incidents
  • Excellent stakeholder management and communication skills
  • Strong report writing and executive presentation abilities
  • Ability to lead and coordinate cross-functional teams across multiple countries and cultures
  • Results-oriented with a continuous improvement mindset

Or refer someone