TrendMicro Hiring! Full Time Senior Incident Response (IR) Analyst in WP Kuala Lumpur - Ricebowl

• Department:*
• Regional Incident Response (AMEA)*
• Reports

To:*

• Manager of the Incident Response Team*
• About the Role*
• We are seeking an experienced Senior Incident Response Analyst to join our security team.

• Key Responsibilities Lead investigations into security incidents, including malware infections, data breaches, and advanced persistent threats (APTs)
• Perform forensic analysis on compromised systems, network traffic, and log data (e.g., WAF, firewall, endpoint, cloud, and application logs)
• Evaluate, pilot, and integrate AI-based tools (e.g., AI-powered SIEM/XDR triage, anomaly detection, LLM-assisted log analysis and report generation) into the incident response lifecycle
• Provide timely, accurate incident reports and executive summaries to stakeholders and customers
• Identify indicators of compromise (IOCs) and threat actor tactics, techniques, and procedures (TTPs), including AI-enabled attack methods.
• Mentor and guide junior analysts on investigation methodology, best practices, and use of AI-assisted tooling
• Create and implement improvements to detection, monitoring, and response capabilities, including AI/automation-driven enhancements
• Maintain awareness of the evolving threat landscape, including emerging vulnerabilities, attack techniques, and AI-related threats (e.g., AI-generated phishing, adversarial ML)
• Support post-incident reviews and root cause analysis to strengthen organizational security posture# *
• Required Qualifications 5
• years of experience in incident response and digital forensics
• Demonstrated experience with AI-related projects or activities in a security context (e.g., deploying or tuning AI-based detection/triage tools, using generative AI/LLMs to accelerate investigations or reporting, building automation that leverages machine learning models)
• Prior experience working directly with clients/customers during live incident engagements
• Strong understanding of network protocols, operating systems (Windows/Linux), and cloud environments (AWS, Azure, GCP)
• Proven experience conducting cloud forensics investigations across major cloud service providers (AWS, Azure, GCP), including:
• Acquiring and analyzing cloud-native artifacts (VM snapshots/disk images, memory captures, container images, serverless function logs)
• Analyzing cloud control plane and audit logs (e.g., Azure Activity Log, AWS CloudTrail, GCP Audit Logs) to reconstruct attacker activity and timelines
• Understanding shared responsibility models and their impact on evidence availability and collection methods
• Investigating incidents involving cloud storage (e.g., S3 buckets, Azure Blob Storage), managed databases, and Kubernetes/container orchestration environments
• Working with volatile and ephemeral cloud resources where traditional forensic imaging techniques may not apply
• Hands-on experience with SIEM platforms, EDR/XDR tools, and log analysis (e.g., Splunk, CrowdStrike, Microsoft Sentinel), including AI-enabled features of these platforms
• Relevant certifications such as GCIH, GCFA, GNFA, CISSP, CEH, OSCP, or cloud-specific credentials.
• Familiarity with WAF, load balancer, and application gateway logs (e.g., Azure Application Gateway, Cloudflare, AWS WAF)
• Solid understanding of the MITRE ATT&CK framework and threat intelligence concepts
• Experience conducting forensic investigations and chain-of-custody procedures, including in distributed and multi-cloud environments
• Excellent written and verbal communication skills, with the ability to translate technical findings for non-technical audiences
• Ability to work under pressure and manage multiple concurrent investigations
• Bachelor's degree in Computer Science, Information Security, or related field (or equivalent experience)*
• Preferred Qualifications Experience with scripting/automation (Python, PowerShell) for investigation tasks, including integrating AI libraries or APIs into workflows
• Practical exposure to concepts such as model training, prompt engineering, or AI governance/risk as applied to cybersecurity
• Experience with cloud-native security tools and container security
• Familiarity with cloud-native forensic and incident response tooling (e.g., AWS Detective, Azure Sentinel, Google Chronicle, Magnet AXIOM Cloud)#LI-ZA1 #LI-Hybrid