Cybersecurity Engineer (SOC)

About the job

We are hiring a hands-on Cybersecurity Engineer (SOC) for our Kuala Lumpur office, open to mid-level or senior candidates. Seniority does not change the job: you do the hands-on work yourself. You report to the CTO and build and run our security monitoring, detection and response. This is not an analyst-only, threat-intel-only or ticketing seat.

This is a new role, and you will be the first and only person in it when you join. You won't be working alone, though: you will use AI agents to help with monitoring, alert triage, investigation, reporting and other SOC work. We are building SOC and security engineering from the ground up with the CTO, so you will set up how monitoring, detection, hardening and response work here.

You are expected to work independently and drive security operations with the CTO's direction, not wait to be tasked ticket by ticket.

A real part of this role is building detection and response capability with Claude Code and AI agents, such as log analysis, alert triage and response tooling, instead of defaulting to expensive commercial platforms when an in-house solution fits. Commercial tools are fine when they earn the cost.

Full on-site, Monday–Friday at Sunway Tower, Jalan Ampang, Kuala Lumpur. No hybrid or remote.

Key responsibilities

SOC & security engineering

• Deploy, tune and maintain Centralised Logging / SIEM / EDR and write detection rules

• Hands-on building or tuning centralised logging / SIEM and EDR, writing detection rules, hardening Linux, Windows or cloud, plus real alert triage and incident handling. Threat-intel-only or analyst-only profiles do not fit

• Harden servers, endpoints and cloud (AWS and Huawei Cloud) against what monitoring and testing show

• Own first-line incident response: containment, evidence notes, recovery support and updates with the CTO

• Support response to ransomware, attacks, data leakage and major incidents

• Keep clear runbooks for common alerts and escalate real risk early

• Support BCM / BCP / DR / incident playbooks and help test them

• Serve as Data Protection Officer (DPO) under Malaysia's PDPA Controls & vulnerability support

• Implement, configure and troubleshoot security controls across apps, cloud, network, endpoints, identity and data

• Run vulnerability scanning and tracking, and coordinate fixes with owners

• Support pentest follow-up (retest, evidence, closure) Automation & AI

• Combine open-source tools, in-house scripts and agents, Claude Code (or comparable), and commercial products only where they add clear value

• Use AI for log and alert analysis, IR support and reporting, responsibly

Skills & experience required

• At least 2 years of hands-on cybersecurity in SOC and security engineering. We consider mid-level and senior candidates, and both roles are hands-on.

• Hands-on building or tuning SIEM / EDR, writing detection rules, hardening Linux, Windows or cloud, plus real alert triage and incident handling. Threat-intel-only or analyst-only profiles do not fit

• Uses AI tools daily in your work

• Experience securing cloud (AWS and Huawei Cloud preferred), Linux, Windows and modern web apps

• Working knowledge of CIS Controls, NIST and MITRE ATT&CK; ISO 27001 awareness is a plus

• Can write scripts (e.g. Python, Bash or PowerShell), build simple automations and integrate tools

• Must hold at least two active (not expired) certifications from this list; three or more strongly preferred:

  • Certified Information Systems Security Professional (CISSP)

  • Certified Information Security Manager (CISM)

  • CompTIA Cybersecurity Analyst+ (CySA+)

  • ISC2 Systems Security Certified Practitioner (SSCP)

  • ISC2 Certified in Cybersecurity (CC)

  • EC-Council Certified Incident Handler (ECIH)

  • Cloud Security Alliance Certificate of Cloud Security Knowledge (CCSK)

  • CREST SOC certification

  • OffSec Incident Responder (OSIR)

  • GIAC Security Operations Certified (GSOC)

  • OffSec Defense Analyst (OSDA)

  • Global ACE Certified Security Operation Centre Analyst (CSOC)

  • EC-Council Certified SOC Analyst (CSA)

  • CompTIA Security+

  • CompTIA Security-X

  • GIAC Security Essential (GSEC)

• Can operate with limited supervision in a lean SME team

• Aligned with the CTO; escalate real risk clearly; finish remediation and verify it stuck

• Willing to be on-call for serious incidents (evenings, weekends or PH when needed)

Nice to have

• Hands-on with Claude Code or similar AI engineering tools to build real detection and response capability, not chat-only

• Open to building your own security tools with Claude Code (willing to self-learn)

• Experience building monitoring in a lean team without a big SIEM budget

• Direct involvement in a real incident (ransomware, compromise or major data loss)

• Working knowledge of Malaysia's PDPA

• Light pentest or purple-team exposure

About the company

ModeFair is an expanding tech venture that excels in GovTech. We provide a holistic suite of services, ranging from strategic counsel and conceptualisation to UI/UX design, custom-made development & integration, and routine IT management.

We aim to retain strong talent with a conducive working environment and competitive benefits. Our culture is fast-paced: everyone uses AI heavily in their daily work, delivery speed and efficiency matter, and we hold people accountable for how they use their time. We promote trust, responsibility, and open communication — and we expect high ownership.