(A) Senior Manager Cyber Threat Intelligence

Kuala Lumpur, Federal Territory of Kuala Lumpur, Malaysia

About the job (A) Senior Manager Cyber Threat Intelligence

Senior Manager, Cyber Threat Intelligence
Department: Group Information Security (GIS)

The role of the candidate is to be a part of the GIS Cybersecurity team to function as a Senior Manager in the Cyber Threat Intelligence Team.
The role requires proactively investigating security events to identify artifacts of a cyber-attack, detect advanced threats that evade traditional security solutions, conduct threat actor-based investigations, create new detection methodologies, and support incident investigations and monitoring functions. Threat hunting includes using both manual and machine-assisted capabilities, aiming to find the Tactics, Techniques, and Procedures (TTPs) of advanced adversaries.

The candidate must possess a curious investigative mindset, have experience in information security, and the ability to communicate complex ideas to varied stakeholders.

Responsibilities include:

1. Develop, document, and maintain a cyber threat hunting framework.
2. Hunt for and identify threat actor groups, techniques, tools, and procedures (TTPs).
3. Perform threat hunting through analysis of anomalous log data to detect and mitigate cyber threat activities.
4. Actively develop threat hunting hypotheses, translating hunt activities into an iterative process, and automating the process of hunting for cyber threats.
5. Review alerts generated by security monitoring tools and provide recommendations to enhance alerts for more efficient monitoring.
6. Provide forensic analysis of network packet captures, DNS, proxies, malware, host-based security, and application logs, as well as logs from various data sources.
7. Provide expert investigative support during large-scale and complex security incidents.
8. Analyze security incidents to enhance security monitoring and alert catalog.
9. Investigate and validate suspicious events using open-source and proprietary intelligence sources.
10. Document and communicate findings to an array of audiences, including both technical and executive teams.
11. Continuously improve processes and use cases on security monitoring tools.
12. Keep up to date with information security news, adversary techniques, and the threat landscape.
13. Support day-to-day operations, ensuring efficient delivery of Cyber Threat Intel services.
14. Involved in additional supporting roles for strategic work and security-related projects.

The role does not require dealing with any financial measures. Timeliness, with the ability to balance delivery speed and work quality, is expected.

Communication Requirements:
Excellent verbal and written communication skills, fluent in English.
Strong interpersonal skills.
Self-learner with a demonstrated ability to understand and keep up to date with the latest technology.
Attention to detail and ability to report on key activities and status.
Analytical capabilities. Knowledge of analysis of competing hypotheses (ACH), logical fallacies, and cognitive biases to provide solutions to problems is a plus.
Familiarity with enterprise controls, related tools, and their limitations.
A team player, with the ability to work independently when tasked to do so in certain situations.

Minimum Job Requirements:

1. Must have a minimum of 8 years of experience in a technical security role in one of the following areas: Operating System security, Network security, Internet or Web security, Endpoint security.
2. Experience with researching and incorporating Cyber Threat Intelligence findings into threat hunting workflows.
3. Knowledge and experience working with the MITRE ATTACK framework, Cyber Kill Chain Model, or Diamond Model.
4. Experience with the incident response process, including detecting advanced adversaries, log analysis, and malware triage.
5. Experience with Netflow or PCAP analysis.
6. Experience with Windows file system and registry functions or *Nix operating system and command line tools.
7. Knowledge and experience in developing detection signatures (YARA, SNORT).
8. Knowledge of malware and threat actor behavior, and how common protocols and applications work at the network level.