Incident Response Lead

Overview

The Incident Response Lead is responsible for leading cyber incident detection investigationcontainment eradication recovery and post incident activities across Axiata Cyber Fusion Center(ACFC). The role provides technical leadership and coordination for cyber incident response digitalforensics threat hunting intelligence-driven defense and continuous improvement of detection andresponse capabilities.

The incumbent will work closely with SOC analysts Security Engineering Threat Intelligence OperationalCompanies (OpCos) Technology teams and external partners to ensure timely and effective handling ofcyber threats and incidents while strengthening the organizations cyber resilience.

Key Responsibilities

Cyber Incident Response & Management

• Lead the end-to-end management of cyber security incidents ensuring appropriate prioritizationinvestigation containment eradication and recovery activities
• Act as the primary escalation point for high-severity security incidents and coordinate incidentresponse activities across OpCos and stakeholders
• Direct cyber incident bridge calls and crisis management activities during major security incidents
• Ensure incident response activities are executed in accordance with established SLAs regulatoryrequirements and organizational policies
• Develop and maintain incident response playbooks runbooksescalation matrices and standardoperating procedures (SOPs)
• Conduct post-incident reviews root cause analysis lessons learned sessions and trackremediation actions

Security Monitoring & Detection Enhancement

• Provide guidance and oversight to SOC analysts and managed security service providers toimprove detection accuracy triage quality and investigation effectiveness
• Review and validate alerts escalated from monitoring teams to ensure accurate contextualizationand prioritization
• Drive continuous enhancement of security monitoring use cases detection content correlationrules and threat detection frameworks
• Collaborate with Security Engineering teams to improve visibility telemetry and detectioncoverage across enterprise environments

Digital Forensics & Malware Analysis

• Lead forensic investigations involving endpoint network cloud and mobile environments
• Perform or oversee digital evidence acquisition preservation analysis and reporting inaccordance with forensic standards
• Conduct advanced malware analysis and reverse engineering activities to determine attackmethodologies indicators of compromise (IOCs) and business impact
• Support legal regulatory and compliance investigations where digital forensic expertise isrequired

Threat Intelligence & Threat Hunting

• Analyze emerging cyber threats vulnerabilities adversary tactics techniques and procedures(TTPs) to improve defensive capabilities
• Convert threat intelligence into actionable detection rules hunting hypotheses and responseactions
• Lead proactive threat hunting activities leveraging MITRE ATT&CK and intelligence-ledmethodologies
• Coordinate with internal and external intelligence sources to assess risks affecting Axiata Groupand OpCos

Automation & Continuous Improvement

• Drive security orchestration automation and response (SOAR) initiatives to improve operationalefficiency and reduce mean time to detect (MTTD) and mean time to respond (MTTR)
• Identify opportunities for process optimization workflow automation and operational maturityenhancements
• Evaluate emerging cyber security technologies and recommend adoption based on business andoperational requirements
• Contribute to the strategic development and maturity roadmap of ACFCs incident responsecapabilities

Security Testing & Readiness

• Coordinate cyber security assessments threat-led exercises tabletop simulations red teamengagements and breach attack simulations
• Validate detection and response capabilities against identified threats and attack scenarios
• Provide guidance and recommendations for remediation and risk reduction initiatives
• Support cyber crisis exercises and preparedness activities across the Axiata Group

Leadership & Stakeholder Management

• Provide technical leadership coaching and mentoring to SOC analysts and incident responders
• Engage effectively with senior management technology teams risk compliance legal andexternal partners during security incidents
• Prepare executive-level incident reports risk summaries and operational metrics
• Foster collaboration across multicultural and geographically distributed teams

Key Performance Indicators (KPIs)

• Achievement of Incident Response SLA and KPI targets
• Reduction in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
• Timely containment and eradication of high and critical severity incidents
• Improvement in detection use case effectiveness and detection coverage
• Successful execution of threat hunting and proactive detection initiatives
• Enhancement of automation and orchestration within incident response processes
• Quality and completeness of forensic investigations and incident reports
• Completion of post-incident reviews and remediation tracking
• Stakeholder satisfaction and effective coordination during major incidents
• Contribution towards ACFC operational maturity and cyber resilience objectives

Person Specifications

Education

• Bachelors Degree in Cyber Security Information Security Computer Science InformationTechnology or related discipline
• Masters degree or relevant advanced studies is an added advantage
  

Experience

• Minimum 8 years of experience in Cyber Security Operations Incident Response or CyberDefense functions
• Minimum 5 years of hands-on experience managing cyber incidents in enterprise or regionalenvironments
• Experience operating within a SOC Cyber Fusion Center CSIRT CERT or Incident Responseenvironment
• Experience managing security incidents across multi-country or regional operations is highlypreferred
• Experience with cloud incident response (Azure AWS GCP) is highly desirable

Professional Certifications (Preferred)

• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Reverse Engineering Malware (GREM)
• Certified Incident Handler (EC-Council ECIH)
• Certified Ethical Hacker (CEH)
• Certified Information Systems Security Professional (CISSP)
• GIAC Certified Intrusion Analyst (GCIA)
• CrowdStrike Certified Incident Responder (CCIR)
• Microsoft Cybersecurity Architect Expert or equivalent

Technical Competencies

• Strong knowledge of incident response lifecycle digital forensics malware analysis and threathunting methodologies
• Deep understanding of MITRE ATT&CK framework cyber kill chain and adversary emulationtechniques
• Strong knowledge of Advanced Persistent Threats (APT) ransomware business emailcompromise insider threats and cloud-focused attacks
• Experience with:
  o SIEM platforms (Microsoft Sentinel Splunk QRadar)
  o EDR/XDR platforms (CrowdStrike Microsoft Defender Carbon Black)
  o SOAR platforms
  o Network Detection & Response (NDR)
  o Threat Intelligence platforms
  o Email Security platforms
  o Cloud Security technologies
• Strong understanding of:
  o TCP/IP networking
  o Network security monitoring
  o Firewalls IDS/IPS
  o DNS Proxy and Web Security
  o Endpoint Security technologies
• Experience performing log analysis packet analysis forensic investigations and advanced threatinvestigations
• Working knowledge of scripting and automation languages such as Python PowerShell Bash orKQL
• Experience in Telecom incident Response will be added advantage
• Experience in FinTech incident Response will be added advantage

Behavioral Competencies

• Strong analytical and problem-solving capabilities
• Ability to perform effectively under pressure during major cyber security incidents
• Excellent stakeholder management and communication skills
• Strong report writing and executive presentation abilities
• Ability to lead and coordinate cross-functional teams across multiple countries and cultures
• Results-oriented with a continuous improvement mindset