Overview
The Incident Response Lead is responsible for leading cyber incident detection, investigation, containment, eradication, recovery, and post incident activities across Axiata Cyber Fusion Center (ACFC). The role provides technical leadership and coordination for cyber incident response, digital forensics, threat hunting, intelligence-driven defense, and continuous improvement of detection and response capabilities.
The incumbent will work closely with SOC analysts, Security Engineering, Threat Intelligence, Operational Companies (OpCos), Technology teams, and external partners to ensure timely and effective handling of cyber threats and incidents while strengthening the organization's cyber resilience.
Key Responsibilities
Cyber Incident Response & Management
- Lead the end-to-end management of cyber security incidents, ensuring appropriate prioritization, investigation, containment, eradication, and recovery activities
- Act as the primary escalation point for high-severity security incidents and coordinate incident response activities across OpCos and stakeholders
- Direct cyber incident bridge calls and crisis management activities during major security incidents
- Ensure incident response activities are executed in accordance with established SLAs, regulatory requirements, and organizational policies
- Develop and maintain incident response playbooks, runbooks, escalation matrices, and standard operating procedures (SOPs)
- Conduct post-incident reviews, root cause analysis, lessons learned sessions, and track remediation actions
Security Monitoring & Detection Enhancement
- Provide guidance and oversight to SOC analysts and managed security service providers to improve detection accuracy, triage quality, and investigation effectiveness
- Review and validate alerts escalated from monitoring teams to ensure accurate contextualization and prioritization
- Drive continuous enhancement of security monitoring use cases, detection content, correlation rules, and threat detection frameworks
- Collaborate with Security Engineering teams to improve visibility, telemetry, and detection coverage across enterprise environments
Digital Forensics & Malware Analysis
- Lead forensic investigations involving endpoint, network, cloud, and mobile environments
- Perform or oversee digital evidence acquisition, preservation, analysis, and reporting in accordance with forensic standards
- Conduct advanced malware analysis and reverse engineering activities to determine attack methodologies, indicators of compromise (IOCs), and business impact
- Support legal, regulatory, and compliance investigations where digital forensic expertise is required
Threat Intelligence & Threat Hunting
- Analyze emerging cyber threats, vulnerabilities, adversary tactics, techniques, and procedures (TTPs) to improve defensive capabilities
- Convert threat intelligence into actionable detection rules, hunting hypotheses, and response actions
- Lead proactive threat hunting activities leveraging MITRE ATT&CK and intelligence-led methodologies
- Coordinate with internal and external intelligence sources to assess risks affecting Axiata Group and OpCos
Automation & Continuous Improvement
- Drive security orchestration, automation, and response (SOAR) initiatives to improve operational efficiency and reduce mean time to detect (MTTD) and mean time to respond (MTTR)
- Identify opportunities for process optimization, workflow automation, and operational maturity enhancements
- Evaluate emerging cyber security technologies and recommend adoption based on business and operational requirements
- Contribute to the strategic development and maturity roadmap of ACFC's incident response capabilities
Security Testing & Readiness
- Coordinate cyber security assessments, threat-led exercises, tabletop simulations, red team engagements, and breach attack simulations
- Validate detection and response capabilities against identified threats and attack scenarios
- Provide guidance and recommendations for remediation and risk reduction initiatives
- Support cyber crisis exercises and preparedness activities across the Axiata Group
Leadership & Stakeholder Management
- Provide technical leadership, coaching, and mentoring to SOC analysts and incident responders
- Engage effectively with senior management, technology teams, risk, compliance, legal, and external partners during security incidents
- Prepare executive-level incident reports, risk summaries, and operational metrics
- Foster collaboration across multicultural and geographically distributed teams
Key Performance Indicators (KPIs)
- Achievement of Incident Response SLA and KPI targets
- Reduction in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
- Timely containment and eradication of high and critical severity incidents
- Improvement in detection use case effectiveness and detection coverage
- Successful execution of threat hunting and proactive detection initiatives
- Enhancement of automation and orchestration within incident response processes
- Quality and completeness of forensic investigations and incident reports
- Completion of post-incident reviews and remediation tracking
- Stakeholder satisfaction and effective coordination during major incidents
- Contribution towards ACFC operational maturity and cyber resilience objectives
Person Specifications
Education
- Bachelor's Degree in Cyber Security, Information Security, Computer Science, Information Technology, or related discipline
- Master's degree or relevant advanced studies is an added advantage
Experience
- Minimum 8 years of experience in Cyber Security Operations, Incident Response, or Cyber Defense functions
- Minimum 5 years of hands-on experience managing cyber incidents in enterprise or regional environments
- Experience operating within a SOC, Cyber Fusion Center, CSIRT, CERT, or Incident Response environment
- Experience managing security incidents across multi-country or regional operations is highly preferred
- Experience with cloud incident response (Azure, AWS, GCP) is highly desirable
Professional Certifications (Preferred)
- GIAC Certified Incident Handler (GCIH)
- GIAC Certified Forensic Analyst (GCFA)
- GIAC Reverse Engineering Malware (GREM)
- Certified Incident Handler (EC-Council ECIH)
- Certified Ethical Hacker (CEH)
- Certified Information Systems Security Professional (CISSP)
- GIAC Certified Intrusion Analyst (GCIA)
- CrowdStrike Certified Incident Responder (CCIR)
- Microsoft Cybersecurity Architect Expert or equivalent
Technical Competencies
- Strong knowledge of incident response lifecycle, digital forensics, malware analysis, and threat hunting methodologies
- Deep understanding of MITRE ATT&CK framework, cyber kill chain, and adversary emulation techniques
- Strong knowledge of Advanced Persistent Threats (APT), ransomware, business email compromise, insider threats, and cloud-focused attacks
- Experience with:
o SIEM platforms (Microsoft Sentinel, Splunk, QRadar)
o EDR/XDR platforms (CrowdStrike, Microsoft Defender, Carbon Black)
o SOAR platforms
o Network Detection & Response (NDR)
o Threat Intelligence platforms
o Email Security platforms
o Cloud Security technologies
- Strong understanding of:
o TCP/IP networking
o Network security monitoring
o Firewalls, IDS/IPS
o DNS, Proxy and Web Security
o Endpoint Security technologies
- Experience performing log analysis, packet analysis, forensic investigations, and advanced threat investigations
- Working knowledge of scripting and automation languages such as Python, PowerShell, Bash, or KQL
- Experience in Telecom incident Response will be added advantage
- Experience in FinTech incident Response will be added advantage
Behavioral Competencies
- Strong analytical and problem-solving capabilities
- Ability to perform effectively under pressure during major cyber security incidents
- Excellent stakeholder management and communication skills
- Strong report writing and executive presentation abilities
- Ability to lead and coordinate cross-functional teams across multiple countries and cultures
- Results-oriented with a continuous improvement mindset