{"id":2810271,"url":"https://alion.io/job/axiata-digital-labs-lead-platform-engineer","title":"Lead - Platform Engineer","company":{"id":62436,"name":"Axiata Digital Labs","domain":"axiatadigitallabs.com","url":"https://alion.io/company/axiata-digital-labs","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Manatal","truth_index":null},"role":"DevOps","role_family":"DevOps","seniority":"lead","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Kuala Lumpur, Malaysia"],"countries":["MY"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":17000,"max_usd":46000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":982},"experience_years_min":6,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure DevOps","optional":false},{"name":"CI/CD","optional":false},{"name":"Git","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false},{"name":"Azure","optional":true}],"status":"live","first_seen_at":"2026-10-18T09:21:37Z","employer_posted_date":"2026-10-18","last_verified_at":"2026-10-21T06:05:18Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Key Responsibilities\nThreat-Informed Detection Engineering\nConvert Red Team and adversary simulation insights into formal detection enhancements\nMap detections to MITRE ATT&CK, define telemetry requirements, and validate log sources & enrichments (ASIM-aligned where applicable)\nPerform post-engagement gap analysis, prioritize fixes in a transparent detection backlog\nEnsure each finding results in:o Improved/validated use case (KQL logic + entity mapping + suppression)\no Updated triage guidance and analyst notes\no Logic Apps playbook enhancement (if applicable)\no Re-testing with Red Team\n\nFull Use Case Development & Improvement Lifecycle\nDesign: data requirements, ASIM mapping, entity model, severity, rationale, ATT&CK coverage\nBuild: KQL logic, enrichment (watchlists/UEBA/context), suppression thresholds, incident settings\nTest: lab data, adversarial replay, quality gates (TP/FP rates, performance)\nDeploy: CI/CD with approvals, release notes, rollback plan\nOperate: health checks, noise reduction, performance optimization(query/runtime)\n\nRetire: deprecate & archive with justification\nStructured improvement cycles: SOC feedback - Engineering validation - Red Team re-test - Content update.\nRed Team - Engineering Collaboration\nLog all Red Team findings as use case candidates in a tracked backlog\nPartner with identity, network, cloud, and platform teams to enable telemetry and close platform gaps\nMaintain measurable outcomes: coverage uplift, detection efficacy, time-to-fix\nSOAR / Logic Apps Playbook Enhancement\nLead improvements to Logic Apps playbooks and automation patterns(enrichment, notifications, ticketing, containment orchestration)\n\nApply attacker-driven learnings to harden playbooks (anti-bypass steps, validation & guardrails)\nEnsure robust error handling, retry policies, timeout controls, connection health monitoring, and Managed Identities/Key Vault hygiene\nInstrument playbooks with telemetry (success/failure, latency, step metrics)\nPlatform Ownership (Microsoft Sentinel)\nOwn connectors, DCR/AMA, ASIM parsers, cost controls (table selection,Basic/Analytics tiers, data caps), Watchlists, Workbooks, Content Hub solutions\n\nGovern RBAC, CI/CD promotion gates, API permissions & service principals\nDrive data quality & health: missing sources, parsing failures, schema drift, time skew, volume anomalies\nOptimize storage/retention/archival, tune query performance and workspace costs\nGovernance, Reporting & Compliance\nMaintain full auditability: change records, approvals, test evidence, version history\nProduce coverage reports (by ATT&CK, asset class, control family) and Red Team uplift metrics\nEnforce segregation of duties and least privilege for SIEM operations\nPerson Specifications\n06 - 10 years in SIEM engineering/detection engineering (Sentinel preferred)\nDeep hands-on with Microsoft Sentinel, KQL, ASIM, Logic Apps, Content Hub, Watchlists, Workbooks\nProven experience partnering with Red Team/Pentesters and running Purple Team validations\nAbility to translate attacker TTPs into telemetry + high-fidelity detections\nSkilled with CI/CD for SIEM (Git, Azure DevOps), Detection-as-Code, and environment promotion\nStrong grasp of cloud identity & auth (Entra ID/OAuth/SAML/Kerberos), network protocols, and Windows/Linux telemetry\nScripting for automation (PowerShell/Python), API integrations, and data normalization\nNice To Have\nExperience with M365 Defender and its bi-directional integrations with Sentinel\nFamiliarity with Fusion/UEBA, ML anomalies, and custom parsers (KQL functions)\nCost engineering for Sentinel (table strategy, Basic vs Analytics, archive/search)","description_format":"text","description_chars":3624,"description_truncated":false,"requirements":{"experience_years_min":6,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":[],"lifecycle":[{"event":"open","at":"2026-10-18T09:21:37Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":29,"reasons":["conf:3","velocity","win:early"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/axiata-digital-labs-lead-platform-engineer","json_url":"https://alion.io/job/axiata-digital-labs-lead-platform-engineer.json","meta":{"generated_at":"2026-10-21T08:07:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11538,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":62436},"rest":"https://alion.io/mcp/rest/get_company?id=62436"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faxiata-digital-labs-lead-platform-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faxiata-digital-labs-lead-platform-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faxiata-digital-labs-lead-platform-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/axiata-digital-labs-lead-platform-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faxiata-digital-labs-lead-platform-engineer"}]}