Senior Manager - SOC Senior Analyst

Overview

Senior Manager - SOC Senior Analyst (SOC L3) supporting threat monitoring, detection, event analysis, incident response, forensics and threat hunting for the Cyber Defense Center (SOC), a 24/7 environment.

What you'll do

• Provide incident response, investigation and remediation support for escalated security alerts and incidents, working flexibly in a 24x7 environment.
• Leverage emerging threat intelligence (IOCs, updated rules, etc.) to identify affected systems and the scope of an attack.
• Perform comprehensive computer monitoring, identifying vulnerabilities, target mapping and profiling.
• Provide support for complex computer/network exploitation and defense techniques, including detecting and investigating computer and network intrusions.
• Provide technical support for forensics services, including evidence seizure, computer forensic analysis and data recovery in support of computer crime investigations.
• Research and maintain proficiency in open and closed source computer exploitation tools, attack techniques, procedures and trends.
• Research emerging threat sources and develop threat profiles; keep updated on the latest cyber security threats.
• Ensure incident identification, assessment, quantification, reporting, communication, mitigation and monitoring.
• Take responsibility for overall use of resources and initiate corrective action where required for the Security Operations Center.
• Create reports, dashboards and metrics for SOC operations and present them to Senior Management and other stakeholders.
• Ensure threat management and threat modelling, identify threat vectors and develop use cases for security monitoring.
• Revise and develop processes to strengthen the Security Operations framework, review policies and highlight challenges in managing SLAs.
• Handle audit-related activities with internal and external stakeholders to ensure policy compliance and adherence to procedures, showcasing evidence and aligning observation reports for process improvement.

What you'll need

• Bachelor's in Computer Science, Cybersecurity, Information Systems or Information Technology, or Master's in Computer Science.
• Relevant experience in cyber security incident response.
• Deeper understanding with some hands-on experience of enterprise IT infrastructure components such as advanced firewalls, IPS/IDS/WIPS/HIPS, routers/switches, TACACS, VPN, proxy, AV, domain controllers, DNS, DHCP, multi-factor authentication, virtualization, email systems/security and DLP.
• Familiarity with cloud environments (AWS, Azure etc.).
• Strong evidence of analytical ability and attention to detail.
• Broad understanding of all stages of incident response.
• Sound understanding of SIEM, PAM, CASB, EDR, SOAR, other threat detection platforms and incident response tools.
• Systematic, disciplined and analytical approach to problem solving.
• Knowledge of the current threat landscape (threat actors, APT, cyber-crime etc.).
• Basic knowledge of Data Loss Prevention monitoring.
• Basic knowledge of audit requirements (PCI, HIPAA, SOX etc.).
• Certifications: CISSP or CompTIA Security+.
• Language: English, proficient (C2).

Details

• Location: Gurgaon (STPI), India.
• Office work; day shift (India); 24x7 SOC environment requiring flexibility for escalations.
• Job type: Regular.