{"id":2346972,"url":"https://alion.io/job/cygnify-assistant-manager-cybersecurity-incident-response","title":"Assistant Manager, Cybersecurity Incident Response","company":{"id":4418503,"name":"Cygnify","domain":"cygnify.io","url":"https://alion.io/company/cygnify","size_band":"51-200","is_staffing_agency":true,"employer_type":"agency","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":75,"open_postings":23,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-14T06:34:16Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Kuala Lumpur, Malaysia"],"countries":["MY"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":18500,"max_usd":44000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":1891},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Elastic SIEM","optional":false},{"name":"ElasticSearch","optional":false},{"name":"Kibana","optional":false},{"name":"Logstash","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-06-10T04:27:39Z","employer_posted_date":"2026-06-10","last_verified_at":"2026-10-14T08:28:57Z","board_verified":true,"closed_at":null,"days_open":126,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":126},"description":"We are currently partnering with a leading technology-driven telecommunications organization that is scaling rapidly to support new digital initiatives and platforms. As part of this expansion, multiple roles are open across key functions to help build, maintain, and enhance next-generation solutions. This opportunity offers exposure to large-scale systems, innovative technologies, and a collaborative environment where skills and ideas make a real impact.\n\nAccountabilities:\nEnd-to-end management of cybersecurity incidents, ensuring timely detection, triage, investigation, and resolution\n\nAchieving and maintaining target MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond) benchmarks.\n\nEffective administration and optimization of the Elastic SIEM platform, including rule creation, tuning, and integrations.\n\nDevelopment of accurate and relevant detection use cases aligned with evolving threat patterns and organizational needs.\n\nEnsuring timely escalation and coordination with internal and external stakeholders during major incidents.\n\nProviding transparent and comprehensive incident reporting to leadership and relevant teams.\n\nDrive operational excellence through monitoring, alerting, timely investigation and continuous fine tuning the alerts\n\nPartner with Data Engineering, Architecture, Security, Infrastructure & Tooling teams to ensure aligned technical cyber security discussions\n\nResponsibilities:\nMonitor, triage, and investigate alerts from multiple log sources (network, endpoint, cloud, and application).\n\nCreate, refine, and manage SIEM detection rules to capture the latest attack patterns.\n\nConduct log analysis and event correlation to identify potential intrusions or malicious behavior.\n\nDrive use case ideation and validation to improve threat detection coverage and accuracy.\n\nManage and maintain Elastic Stack components (Elasticsearch, Logstash, Kibana, Beats) for operational efficiency.\n\nLead integration efforts with tools such as EDR, firewalls, cloud platforms, and ticketing systems.\n\nCollaborate with IT, Network, and Cloud teams for incident follow-up, containment, and recovery.\n\nPresent incident findings, root cause analyses, and remediation plans to key stakeholders (internal leadership and external partners).\n\nDocument and enhance incident response playbooks and standard operating procedures (SOPs).\n\nConduct post-incident reviews and implement lessons learned to strengthen the organization's security posture.\n\nRequirements\n5-8 years of experience in Security Operations Center (SOC), Incident Response, or Detection Engineering roles.\n\nProven success in SIEM administration, particularly Elastic Stack (ELK) environments.\n\nHands-on expertise in incident triage, log analysis, and detection rule engineering.\n\nDemonstrated ability to design and operationalize MITRE ATT&CK-aligned use cases.\n\nExperience in cross-department collaboration and incident coordination with IT and business teams.\n\nStrong presentation and communication experience in stakeholder-level incident discussions.\n\nRelevant certifications such as CISSP,GCIH, GCIA, CEH, or Elastic Certified Engineer preferred.","description_format":"text","description_chars":3143,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Malaysia","iso":"MY","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response","Security Operations"],"lifecycle":[{"event":"open","at":"2026-10-12T12:53:04Z"}],"visa":[],"liveness":{"score":4,"band":"cold","label":"Long shot","p_open":1,"p_active":0.133,"p_room":0.28,"age_days":126,"expected_fill_days":38,"reasons":["conf:3","agency","stale_co","win:tail","crowd:"],"computed_at":"2026-10-14T06:34:16Z"},"pay":null,"html_url":"https://alion.io/job/cygnify-assistant-manager-cybersecurity-incident-response","json_url":"https://alion.io/job/cygnify-assistant-manager-cybersecurity-incident-response.json","meta":{"generated_at":"2026-10-14T11:57:59Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14467,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4418503},"rest":"https://alion.io/mcp/rest/get_company?id=4418503"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcygnify-assistant-manager-cybersecurity-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcygnify-assistant-manager-cybersecurity-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcygnify-assistant-manager-cybersecurity-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cygnify-assistant-manager-cybersecurity-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcygnify-assistant-manager-cybersecurity-incident-response"}]}