Assistant Vice President – (SOC)
On-siteKuala Lumpur, Kuala Lumpur, Malaysia
Job Summary
Manage daily SOC detection and analysis workflows as the primary escalation point for complex investigations, overseeing shift operations and tiered monitoring to ensure continuous coverage. Lead technical bridges during incident escalation, coordinating containment before elevating severe crises, while owning SIEM, UEBA, EDR, and NDR telemetry pipelines for high-fidelity log ingestion. Develop and tune MITRE ATT&CK-based detection content to reduce false positives and partner with Cyber Engineering to automate SOAR playbooks for enrichment and ticketing. Enforce SLA compliance with outsourced MSSP/MDR providers, audit logging coverage across critical assets, and execute hypothesis-driven threat hunting across networks, endpoints, and cloud environments. Operationalize threat intelligence feeds into deployable rules and maintain defensible logs for regulatory audits. Mentor SOC analysts, define skills matrices, and lead cybersecurity modernization projects to reduce MTTA and improve automation indices.
Required Qualifications
- Bachelor's degree in Computer Science, Information Security, Computer Engineering, or related field
- 7–10+ years of professional cybersecurity experience
- 3–5 years in SOC leadership or advanced incident response
- Hands-on expertise with enterprise-grade security tools (Splunk, QRadar, CrowdStrike, SentinelOne, Palo Alto Cortex XSOAR, MISP)
- Strong operational knowledge of MITRE ATT&CK, NIST SP 800-61, and cyber kill chain strategies
- Proven skills in digital forensics, log analysis, network traffic analysis, and structured RCA
- Ability to analyze endpoint, network, cloud, and identity telemetry to reconstruct complex attack chains
- Strong execution focus with command over metrics, playbooks, and operational gates
- Logical rigor and rapid execution during high-stakes incidents
- Excellent communication skills to manage relationships with internal teams and external MSSP vendors
- GIAC Certified Intrusion Analyst (GCIA)
- GIAC Certified Incident Handler (GCIH)
- GIAC Continuous Monitoring Certification (GMON)
- GIAC Certified Forensic Analyst (GCFA)
- GIAC Cyber Threat Intelligence (GCTI)
- CISSP or CISM
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.