About Us
Our journey began in 1966 - from a construction company, we have emerged to become one of Malaysia's leading engineering-based infrastructure and services group and today, we have expanded our presence into green industries.
Our presence today transcends the borders of Malaysia into emerging and developed countries, focusing on five key businesses namely Expressways, Township & Property Development, Engineering & Construction, Asset & Facility Management and Green Industries.
Our ability, expertise and resources enable us to deliver and manage key infrastructure development projects catering to both public and private sectors.
A wholly owned subsidiary of Khazanah Nasional Berhad, the sovereign wealth fund of Malaysia, our obligation goes beyond delivering financial numbers as we also safeguard and protect the interest of our nation and its people. In everything that we do, we aim to leave significant impact to everyone involved.
We are UEM Group.
Job Brief
To lead the design, implementation and continuous enhancement of cybersecurity strategies, frameworks and technical controlsincluding MFA, encryption, EDR and other critical defence capabilitiesin alignment with the UEM Security Roadmap. This role ensures compliance with UEM Group IT frameworks, the Cyber Security Act, NIST and ISO 27001 standards, while overseeing end-to-end incident response, vulnerability management, and technical patching coordination to safeguard critical systems and support business objectives.
Job Accountabilities
- To lead the implementation and maintenance of technical security controls (e.g., MFA, Encryption, EDR) to ensure compliance with UEM Group IT frameworks, Cyber Security Act, National Institute of Standards and Technology (NIST) and ISO 27001 standards.
- To lead technical incident response by managing triage, containment and eradication activities using Security Information & Event Management (SIEM)/ Security Orchestration, Automation and Response (SOAR) playbooks.
- To maintain and execute the group-wide vulnerability management program through regular scanning, prioritisation of critical flaws and coordination of technical patching with IT teams.
- To oversee daily SIEM/Security Operations Centre (SOC) monitoring operations (e.g.Wazuh) by ensuring log ingestion, tuning alert rules and conducting proactive threat-hunting.
- To lead the establishment and enforcement of secure configuration baselines (e.g., Centre for Internet Security (CIS) benchmarks) for servers, Azure cloud environments and endpoints.
- To oversee operational Identity & Access Management (IAM) by managing privileged account controls, enforcing Role-Based Access Control (RBAC) policies and performing monthly access reviews.
- To design and deliver data defence operations by deploying and tuning DLP agents and encryption tools to protect PDPA-regulated data.
- To provide technical project assurance through security reviews and hands-on configuration audits prior to system go-live.
- To maintain and automate the provision of technical proof-of-control (logs, screenshots, reports) required for internal and external audits.
- To track and report operational cybersecurity metrics including Mean Time to Detect (MTTD), Mean Time to Respond/Recovery (MTTR) and patching cadence for continuous performance improvement.
Requirements
- Bachelor's degree in Cybersecurity, IT, Computer Science or Computer Engineering
- Preferred functional exposure with minimum 7 years experience in cybersecurity governance, risk & compliance
- Possess knowledge in incident response, threat detection (SIEM/SOAR) & forensics handling
- Professional certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or Certified Cloud Security Professional (CCSP) are highly preferred and will be an added advantage.
