Senior Threat Detection Engineer
Get to Know the Team
Our Detection Engineering function in Cyber Defence is responsible for detecting, managing, and responding to malicious activity across Grab's infrastructure — from cloud and SaaS to endpoints and identity platforms. We follow our detection-as-code framework and lifecycle, G-DARF (Grab Detection, Alerting and Response Framework).
You will be reporting to the Security Automation and Detection Engineering Manager, partnering with the Security Operations team, platform teams, and other cyber functions.
Get to Know the Role
We are looking for a Security Engineer (Detection Engineering) – to research and build new detection capabilities, with a primary focus on:
- Amazon EKS and containerized microservices
- AI / MCP and agentic systems security detections
- Autonomous vehicle / IOT platforms and supporting infrastructure
- Other new threats identified through incidents, threat intel, purple teaming, and ongoing findings
This is a hands-on, engineering-heavy role that combines threat research, security operations experience, and software engineering.
This is a fully onsite role, and will be based at our office in Petaling Jaya.
The Critical Tasks You Will Perform
- Research new detections
- Research attacker TTPs relevant to focus areas and translate them into concrete detection opportunities.
- Perform focused analysis of log sources (e.g., Kubernetes/EKS, CloudTrail, GuardDuty, AV telemetry, AI/agent frameworks) to understand visibility, constraints, and potential blind spots.
- Collaborate with threat intel, red/purple team, incident responders, and platform teams to turn incident insights and threat intel into proactive detections, improve log coverage, and validate assumptions.
- Build, test, and deploy detection logic
- Implement high-fidelity detection rules and analytics across SIEM, EDR, SOAR, and custom detection frameworks. Follow detection-as-code practices, including version control, code review, automated tests, and CI/CD.
- Prototype and validate detection logic against large-scale log data in the Security Data Lake using SQL/KQL.
- Ensure detection logic is operationally sound: performant at scale, and suitable for near real‑time and batch use cases.
- Lead the detection lifecycle and tuning
- Participate in daily detection lifecycle activities: backlog grooming, prioritisation, development, staging, deployment, monitoring, and iterative tuning.
- Review alert quality, false positive patterns, and coverage gaps; create targeted fine-tuning and suppression strategies to reduce alert fatigue while preserving coverage.
- Support the creation and tracking of detection metrics (e.g., time to deploy, false positive rate, coverage, detection MTTR inputs) and use them to guide continuous improvement.
- Incident and response support
- Triage and investigate alerts with CSIRT if required, validate our detection hypotheses, and deliver emergency detections when we discover active threats.
- Provide clear guidance on expected behaviour, triage steps, and response actions so responders can act.
- Participate (where required) in ad‑hoc or rostered on‑call / incident support to address urgent security matters.
- Documentation, communication and collaboration
- Produce high-quality detection documentation (goal, context, logic, false positives, blind spots, response runbook) aligned to our detection framework standards.
- Present new detections and alerts to Cyber Defence; explain the why, how, and operational impact.
What Essential Skills You Will Need
- A degree in Computer Science, Software Engineering, Cyber Security or related fields
- Hands-on security response experience (e.g., SOC, DFIR, and security engineering) with experience investigating incidents, writing timelines, and driving remediation.
- 3+ years of experience with at least one cloud platform (Azure, AWS, GCP)
- Direct experience working with SIEM, EDR and SOAR platforms in an operational environment (e.g., building rules, dashboards, runbooks, or integrations).
- Coding skills in at least one general‑purpose language ( Python/Go) for building detection logic, data processing scripts, and automation/integration workflows.
- Comfortable writing detection and investigation queries in SQL, including working with large security datasets in a data‑lake or big‑data environment.
- Experience tuning detection rules across multiple log sources (cloud, endpoint, network, identity, SaaS).
- Experience using AI
About Grab and Our Workplace
Grab is Southeast Asia's leading superapp. From getting your favourite meals delivered to helping you manage your finances and getting around town hassle-free, we've got your back with everything. In Grab, purpose gives us joy and habits build excellence, while harnessing the power of Technology and AI to deliver the mission of driving Southeast Asia forward by economically empowering everyone, with heart, hunger, honour, and humility.
Life at Grab
We care about your well-being at Grab, here are some of the global benefits we offer:
- We have your back with Term Life Insurance and comprehensive Medical Insurance.
- With GrabFlex, create a benefits package that suits your needs and aspirations.
- Celebrate moments that matter in life with loved ones through Parental and Birthday leave, and give back to your communities through Love-all-Serve-all (LASA) volunteering leave
- We have a confidential Grabber Assistance Programme to guide and uplift you and your loved ones through life's challenges.
- Balancing personal commitments and life's demands are made easier with our FlexWork arrangements such as differentiated hours
What We Stand For At Grab
We are committed to building an inclusive and equitable workplace that provides equal opportunity for Grabbers to grow and perform at their best. We consider all candidates fairly and equally regardless of nationality, ethnicity, race, religion, age, gender, family commitments, physical and mental impairments or disabilities, and other attributes that make them unique.
View our location
For over a decade, Grab has seamlessly connected Malaysian people to a range of services—food, groceries, rides, and more. Take a tour and get to know this one-stop destination for making life more convenient for the local community.
Meet the Security team
Our Security people are the guardians of all information across the company. We're the folks who plan, execute, and set rules to keep everything – from people to places and the important stuff – super secure.
The team is made up of tenacious individuals who never take ‘impossible’ for an answer. We chisel away at problems bit by bit and sometimes we tear the house down completely – but we never walk away from solving some of the biggest challenges that could compromise our users' trust and safety.
“ ”
Integrity is a fascinating field to be in. Saving a life by preventing a road accident, blocking an account takeover by a fraudster, or outsmarting a scrupulous driver attempting to make fake bookings; all of these are challenging and interesting problems to solve. We use a tonne of data, algorithms, and tech, but it's just as crucial to get what's happening on the ground and in the minds of users and fraudsters to drive results.
“ ”
Embrace challenges and continue to build up your skills and knowledge in the fast-paced, changing world of technology. That’s how you succeed at Grab.
“ ”
The Application Process
What can you expect when you apply for a role at Grab? Here’s what our hiring process looks like.
Step 1: Apply.
We have a range of open roles from Marketing to Engineering and everything in between. Find the one that’s best for you and show us why you’re our next teammate.
Step 2: Getting to know you.
Next, you’ll have a video or phone interview with one of our recruiters to chat about you, the role, and your past work experiences.
Step 3: Testing, testing… 123.
Some roles might require assessments and/or a technical competency interview. For other roles, there might be an additional interview – speak with your recruiter for application details.
Step 4: Is it a culture match?
Finally, we’ll find out how we fit together, if your career vision aligns with our mission, how you embody the 4 H's, and your working style and personality.
