This interview is part of GovInsider’s inaugural Cybersecurity Champions report featuring public sector cybersecurity officials around the world.
Please give a brief description of your job function as a cybersecurity professional, as well as what your organisation does.
As Senior Assistant Director at the National Cyber Coordination and Command Centre (NC4), National Cyber Security Agency (NACSA) Malaysia, I oversee a multidisciplinary team that collects, analyses and disseminates cyber-threat intelligence for both government bodies and national critical information infrastructure (NCII) entities.
We draw upon internal and external sources to convert raw information into actionable insights, guiding national early-warning systems, incident response and strategic planning.
NC4 itself functions as the country’s nerve centre for cyber coordination: we maintain 24/7 situational awareness of high-impact events and facilitate seamless collaboration between agencies under NACSA’s mandate stated in Cyber Security Act 2024 to protect Malaysia’s cyberspace.
Which broad categories of cyber threats (e.g. nation-state, organised cybercrime, insider risk) does NACSA prioritise in its strategic planning, and how does that inform your threat-assessment framework?
We view adversaries as three overarching groups: sophisticated nation-state actors whose stealthy operations often target strategic assets; organised cyber-crime syndicates focused on financial gain through ransomware campaigns, data exfiltration and fraud; and insider or opportunistic threats ranging from well-meaning but negligent staff to “script kiddies”.
By mapping each category against our established risk framework, we ensure that the characteristic tactics, techniques and procedures of each group inform our priority settings, intelligence-collection requirements and the allocation of defensive resources.
In your view, what are the biggest threats and challenges (be it in the network layer, and/or in areas such as scams, phishing and identity theft) in the public sector cybersecurity scene globally?
Globally, the public sector grapples with the vulnerability of ageing systems that struggle to meet evolving security demands, resource constraints in terms of skilled personnel and research budgets that hamper proactive resilience measures, and entrenched inter-agency silos that impede rapid information-sharing and coordinated response.
Overcoming these challenges demands concerted efforts to modernise technology platforms, reform governance structures to incentivise collaboration, and establish interoperable channels for threat intelligence exchange.
To subscribe to the GovInsider bulletin, click here.
Many say that we are entering an age of AI-driven cyberwarfare where both hackers and cybersecurity professionals use AI tools for attack and defence. What is your view?
AI in cyber operations presents a double-edged sword: adversaries can harness machine-speed automation for phishing, deep-fake social engineering and adaptive malware, while defenders leverage AI-enabled anomaly detection, predictive modelling and autonomous triage to distinguish genuine threats from background noise.
In the coming years, I expect AI-vs-AI confrontations to become the norm, pitting our algorithmic defences against adversarial-learning techniques.
Success will depend on robust AI governance, continuous validation of our models and a steadfast commitment to staying ahead of malicious innovations.
Cybersecurity is often described as a team sport whereby a network’s vulnerability is often defined by its weakest link. In this context, how important is having a whole-of-government or whole-of-country cybersecurity posture?
A unified posture is indispensable because cyber adversaries do not respect bureaucratic boundaries nor the lines drawn on a map.
By adopting a Whole-of-Nation (WoN) approach, we guarantee seamless incident response, consistent enforcement of policies and centralised fusion of threat intelligence.
Through shared standards, a joint situational-awareness platform and collaborative exercises, we eliminate blind spots, accelerate decision-making and raise the operational cost for any actor seeking to exploit gaps between agencies.
How does Malaysia’s resilience strategy ensure continuity of critical services in the event of a major cyber incident, without compromising operational security?
Malaysia’s resilience strategy ensures continuity of critical services through proactive coordinated national planning, sector-specific code of practice, and business continuity practices to address potential service disruptions.
It prioritises organisational readiness via layered defences and isolated redundancies, while strategic-level crisis simulations with key sectors test coordination and decision-making without disclosing sensitive operational details.
This approach safeguards essential functions while maintaining operational security and institutional trust.
If your organisation gave you an unlimited budget for cyber defence, what would you spend it on?
My foremost investment would be in people rather than platforms. Trust doesn’t begin in boardrooms; it’s built when the right people are empowered to grow, lead, and stay committed.
It begins when talented individuals with integrity choose to stay and grow as knowledge especially tacit knowledge is the most valuable asset for a country.
I would therefore prioritise recruiting and nurturing individuals of exceptional aptitude and dedication, focusing on quality over quantity through specialised fellowships, mentorship schemes and bespoke simulation academies.
Talent in cyber security is not like building Lego bricks, where parts can be interchangeable; it’s more like assembling Gunpla; every piece has its unique fitting, and the Gundam model kit cannot stand tall if the leg has yet to be assembled.
Only after we have established this cadre of world-class cyber defenders with great tacid knowledge would I allocate resources to next-generation telemetry, advanced AI/ML research and initiatives to strengthen our technology sovereignty.
After all, the most sophisticated tools are powerless in unprepared hands.
What brought you to this profession and what do you love the most in your job and what would you like to improve?
In the public service, it’s common that we don’t get to choose our specialisation. Our postings depend on agency needs and available vacancies.
I found myself assigned to the cyber security domain early in my government career and have since learnt a variety of tradecraft, from incident response to threat actor profiling. Over the years, I gravitated towards threat intelligence because I discovered a genuine passion for uncovering adversaries’ methods and translating those findings into protective measures.
What I enjoy most is the combination of technical challenge and public-service purpose; each investigation feels like a complex puzzle that directly contributes to national cyber resilience.
Moving forward, I aim to improve my ability to communicate these technical insights at the executive level, ensuring that our strategic recommendations resonate with policymakers and secure the resources needed to stay ahead of emerging threats.
The lack of qualified cybersecurity professionals is a global problem, how do you think this can be overcome?
Addressing the talent gap demands incorporating general cybersecurity awareness and foundational concepts into STEM education policies from secondary education onwards to build a future pipeline.
It also requires forging public-private partnerships that offer graduates hands-on rotations in security operations centres, and delivering modular, on-demand certifications to upskill mid-career IT professionals, enabling them to pivot into cybersecurity roles without restarting their careers entirely.
If you had a chance to restart your career from scratch, would you still want to be cybersecurity professional and why?
Honestly, probably not! *laugh*.
The adrenaline rush that comes with tracking threat activity in real time at three in the morning is unparalleled, but every time I walk past my PS5 and see it gathering dust, I’m reminded that life’s too short not to finish the latest exclusive!
Nonetheless, knowing what I know now, I’d still choose a field that never sleeps, just so I could put off hunting Arch-Tempered Rey Dau in Monster Hunter: Wilds for a little less time.
