Head - SOC Incident Response

Leadership and Strategy Development:

• Lead enterprise-wide cybersecurity incident response strategy, ensuring alignment with business objectives and organizational risk appetite.
• Act as the primary incident commander for high-severity (P1/P0) cybersecurity incidents, driving decisive action under pressure.
• Define and mature the organization’s incident response operating model, playbooks, escalation paths, and KPIs.
• Provide strategic guidance to SOC and security teams to improve detection fidelity, response efficiency, and resilience.
• Present incident posture, trends, and security maturity insights to senior leadership and executive stakeholders.
  

Risk Management:

• Assess and prioritize cybersecurity incidents based on business impact, threat severity, and operational risk.
• Ensure root cause analysis (RCA) is conducted post-incident to identify control gaps and systemic risks.
• Translate incident learnings into corrective and preventive actions, reducing recurrence risks.
• Support enterprise risk assessments by contributing incident data, threat trends, and exposure insights.
• Coordinate with business units to manage residual risk and track remediation to closure.

Secure Software Development Lifecycle (SDLC):

• Collaborate with application and product teams to integrate incident learnings into secure SDLC practices.
• Provide guidance on incident-driven improvements to secure coding, dependency management, and environment hardening.
• Engage with development teams during security incidents involving applications, APIs, or CI/CD pipelines.
• Support post-incident reviews to strengthen preventive controls across design, development, and deployment stages.
  

Application Security Testing and Tools:

• Support application-level investigations, including log analysis, attack-path validation, and exploitation assessment.
• Leverage application security testing outputs (SAST, DAST, SCA) to correlate findings with real-world incidents.
• Work with AppSec teams to validate exploitability of vulnerabilities identified during incidents.
• Ensure application-level remediation actions are verified and tracked to closure.
  

Compliance and Governance:

• Ensure incident response processes align with industry standards and regulatory requirements (NIST, ISO 27001, company policies).
• Maintain and update incident response SOPs, playbooks, and governance documentation.
• Support audits and compliance reviews by providing incident evidence, metrics, and response effectiveness reports.
• Track business unit adherence to incident remediation SLAs and governance requirements.

Incident Response and Threat Intelligence:

• Lead end-to-end incident response activities: detection, triage, containment, eradication, and recovery.
• Work closely with SOC analysts in a 24x7 environment to validate alerts and escalate high-risk threats.
• Perform hands-on investigations using SIEM, EDR, and forensic tools across endpoints, networks, and cloud environments.
• Conduct malware analysis, log correlation, and threat hunting to identify advanced or persistent threats.
• Integrate threat intelligence (IOCs, TTPs, MITRE ATT&CK mapping) into proactive detection and response improvements.

Training and Awareness:

• Mentor SOC analysts and junior incident responders on investigation techniques and response best practices.
• Conduct incident response simulations, tabletop exercises, and post-incident knowledge-sharing sessions.
• Drive continuous skill development across security operations teams.
• Promote a strong incident response culture with accountability and learning focus.

Collaboration with Other Security Teams:

• Partner with SOC, Vulnerability Assessment, Network, Cloud, Application, and Infrastructure teams during incidents.
• Coordinate endpoint-level remediation with IT and infrastructure teams to ensure timely closure.
• Act as a central bridge between security operations and business units during crisis situations.
• Foster cross-team collaboration while enforcing response and remediation accountability.

Tool Selection and Automation:

• Lead or influence selection and optimization of SIEM, EDR, SOAR, and forensic tools.
• Identify opportunities to automate alert triage, incident enrichment, and response workflows.
• Continuously improve tooling coverage and effectiveness based on incident feedback and threat evolution.
• Ensure tools are tuned to reduce false positives while maintaining high detection accuracy.

Vendor and Third-Party Risk Management:

• Coordinate incident response activities involving third-party vendors or service providers.
• Assess security incidents impacting vendors and evaluate downstream business risk.
• Support remediation tracking and compliance verification for third-party incident-related actions.
• Work with procurement and governance teams to incorporate incident response expectations into vendor engagements.
  
  

Non‑Negotiable & Role-Critical Requirements:

• 15–20 years of cybersecurity experience, with 5+ years in hands-on incident response and SOC operations.
• Proven leadership during high-severity, business-impacting security incidents.
• Strong, practical expertise in SIEM, EDR, malware analysis, and threat hunting.
• Deep understanding of network security, TCP/IP, cloud security, and modern attack techniques.
• Certifications such as GCIH, GCFA, or equivalent are mandatory.

On-site availability in Ahmedabad (no remote/hybrid flexibility).

Key Stakeholders - Internal:

• Executive Leadership
• Department Heads
• System Administrators and Operations
• Internal Auditors
• Legal and Compliance
• Security Awareness and Training Teams

Key Stakeholders - External:

• External Security Consultants
• Regulatory and Government Bodies
• Contractors and Service Providers
• Customers and Clients
• Insurance Providers

Educational Background & Professional Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a closely related technical discipline.
• Advanced degree such as a Master’s or MBA in Cybersecurity, Information Assurance, Information Security, or Risk Management is preferred.
• Industry-recognized incident handling and response certifications such as GCIH, GCFA, GCIA, CEH, or CISSP.
• Additional SOC, Threat Hunting, and platform-specific certifications (SIEM, EDR, SOAR tools) are considered a strong advantage.
• Demonstrated proficiency in SIEM platforms, EDR solutions, and forensic analysis tools.
• Hands-on experience with malware analysis, log analysis, threat hunting, and incident investigations.
• Strong foundation in TCP/IP networking, network security architecture, and cloud security principles.

Working knowledge of leading security frameworks and methodologies, including NIST, MITRE ATT&CK, and ISO 27001.