{"id":925997,"url":"https://alion.io/job/grab-senior-threat-detection-engineer","title":"Senior Threat Detection Engineer","company":{"id":158,"name":"Grab","domain":"grab.com","url":"https://alion.io/company/grab","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"B","score":75,"open_postings":57,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":30,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Petaling Jaya, Malaysia"],"countries":["MY"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":17500,"max_usd":41000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Fine-tuning","optional":false},{"name":"GCP","optional":false},{"name":"Kubernetes","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SQL","optional":false}],"status":"live","first_seen_at":"2026-09-15T04:04:21Z","employer_posted_date":"2026-09-15","last_verified_at":"2026-11-08T18:47:19Z","board_verified":true,"closed_at":null,"days_open":54,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":54},"description":"About Grab and Our Workplace\nGrab is Southeast Asia's leading superapp. From getting your favourite meals delivered to helping you manage your finances and getting around town hassle-free, we've got your back with everything. In Grab, purpose gives us joy and habits build excellence, while harnessing the power of Technology and AI to deliver the mission of driving Southeast Asia forward by economically empowering everyone, with heart, hunger, honour, and humility.\n Get to Know the Team\nOur Detection Engineering function in Cyber Defence is responsible for detecting, managing, and responding to malicious activity across Grab's infrastructure - from cloud and SaaS to endpoints and identity platforms. We follow our detection-as-code framework and lifecycle, G-DARF (Grab Detection, Alerting and Response Framework).\nYou will be reporting to the Security Automation and Detection Engineering Manager, partnering with the Security Operations team, platform teams, and other cyber functions.\nGet to Know the Role\nWe are looking for a Security Engineer (Detection Engineering) - to research and build new detection capabilities, with a primary focus on:\nAmazon EKS and containerized microservices\nAI / MCP and agentic systems security detections\nAutonomous vehicle / IOT platforms and supporting infrastructure\nOther new threats identified through incidents, threat intel, purple teaming, and ongoing findings\nThis is a hands-on, engineering-heavy role that combines threat research, security operations experience, and software engineering.\nThis is a fully onsite role, and will be based at our office in Petaling Jaya.\nThe Critical Tasks You Will Perform\nResearch new detectionsResearch attacker TTPs relevant to focus areas and translate them into concrete detection opportunities.\nPerform focused analysis of log sources (e.g., Kubernetes/EKS, CloudTrail, GuardDuty, AV telemetry, AI/agent frameworks) to understand visibility, constraints, and potential blind spots.\nCollaborate with threat intel, red/purple team, incident responders, and platform teams to turn incident insights and threat intel into proactive detections, improve log coverage, and validate assumptions.\n\nBuild, test, and deploy detection logicImplement high-fidelity detection rules and analytics across SIEM, EDR, SOAR, and custom detection frameworks. Follow detection-as-code practices, including version control, code review, automated tests, and CI/CD.\nPrototype and validate detection logic against large-scale log data in the Security Data Lake using SQL/KQL.\nEnsure detection logic is operationally sound: performant at scale, and suitable for near real-time and batch use cases.\n\nLead the detection lifecycle and tuningParticipate in daily detection lifecycle activities: backlog grooming, prioritisation, development, staging, deployment, monitoring, and iterative tuning.\nReview alert quality, false positive patterns, and coverage gaps; create targeted fine-tuning and suppression strategies to reduce alert fatigue while preserving coverage.\nSupport the creation and tracking of detection metrics (e.g., time to deploy, false positive rate, coverage, detection MTTR inputs) and use them to guide continuous improvement.\n\nIncident and response supportTriage and investigate alerts with CSIRT if required, validate our detection hypotheses, and deliver emergency detections when we discover active threats.\nProvide clear guidance on expected behaviour, triage steps, and response actions so responders can act.\n Participate (where required) in ad-hoc or rostered on-call / incident support to address urgent security matters.\n\nDocumentation, communication and collaborationProduce high-quality detection documentation (goal, context, logic, false positives, blind spots, response runbook) aligned to our detection framework standards.\nPresent new detections and alerts to Cyber Defence; explain the why, how, and operational impact.\n\n What Essential Skills You Will Need\nA degree in Computer Science, Software Engineering, Cyber Security or related fields\n Hands-on security response experience (e.g., SOC, DFIR, and security engineering) with experience investigating incidents, writing timelines, and driving remediation.\n3+ years of experience with at least one cloud platform (Azure, AWS, GCP)\nDirect experience working with SIEM, EDR and SOAR platforms in an operational environment (e.g., building rules, dashboards, runbooks, or integrations).\n Coding skills in at least one general-purpose language ( Python/Go) for building detection logic, data processing scripts, and automation/integration workflows.\nComfortable writing detection and investigation queries in SQL, including working with large security datasets in a data-lake or big-data environment.\nExperience tuning detection rules across multiple log sources (cloud, endpoint, network, identity, SaaS).\nExperience using AI\n Life at Grab\nWe care about your well-being at Grab, here are some of the global benefits we offer:\nWe have your back with Term Life Insurance and comprehensive Medical Insurance.\nWith GrabFlex, create a benefits package that suits your needs and aspirations.\nCelebrate moments that matter in life with loved ones through Parental and Birthday leave, and give back to your communities through Love-all-Serve-all (LASA) volunteering leave\nWe have a confidential Grabber Assistance Programme to guide and uplift you and your loved ones through life's challenges.\nBalancing personal commitments and life's demands are made easier with our FlexWork arrangements such as differentiated hours\nWhat We Stand For At Grab\nWe are committed to building an inclusive and equitable workplace that provides equal opportunity for Grabbers to grow and perform at their best. We consider all candidates fairly and equally regardless of nationality, ethnicity, race, religion, age, gender, family commitments, physical and mental impairments or disabilities, and other attributes that make them unique.","description_format":"text","description_chars":5963,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Health insurance","Life insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Security Operations","Delivery","Ride Hailing","Digital Banks & Neobanks"],"lifecycle":[{"event":"open","at":"2026-09-15T07:17:07Z"}],"visa":[],"liveness":{"score":18,"band":"cold","label":"Long shot","p_open":1,"p_active":0.497,"p_room":0.36,"age_days":54,"expected_fill_days":30,"reasons":["conf:3","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-11-08T05:47:12Z"},"pay":null,"html_url":"https://alion.io/job/grab-senior-threat-detection-engineer","json_url":"https://alion.io/job/grab-senior-threat-detection-engineer.json","meta":{"generated_at":"2026-11-08T19:54:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":41646,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":158},"rest":"https://alion.io/mcp/rest/get_company?id=158"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgrab-senior-threat-detection-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgrab-senior-threat-detection-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgrab-senior-threat-detection-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/grab-senior-threat-detection-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgrab-senior-threat-detection-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":925997}},{"tool":"search_jobs","arguments":{"company":"grab.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":925997},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}