Head - SOC Incident Response

Leadership and Strategy Development:

• Lead enterprise-wide cybersecurity incident response strategy, ensuring alignment with business objectives and organizational risk appetite. 


• Act as the primary incident commander for high-severity (P1/P0) cybersecurity incidents, driving decisive action under pressure. 


• Define and mature the organization’s incident response operating model, playbooks, escalation paths, and KPIs. 


• Provide strategic guidance to SOC and security teams to improve detection fidelity, response efficiency, and resilience. 


• Present incident posture, trends, and security maturity insights to senior leadership and executive stakeholders.
  
   

Risk Management:

• Assess and prioritize cybersecurity incidents based on business impact, threat severity, and operational risk. 


• Ensure root cause analysis (RCA) is conducted post-incident to identify control gaps and systemic risks. 


• Translate incident learnings into corrective and preventive actions, reducing recurrence risks. 


• Support enterprise risk assessments by contributing incident data, threat trends, and exposure insights. 


• Coordinate with business units to manage residual risk and track remediation to closure.

Secure Software Development Lifecycle (SDLC):

• Collaborate with application and product teams to integrate incident learnings into secure SDLC practices. 


• Provide guidance on incident-driven improvements to secure coding, dependency management, and environment hardening. 


• Engage with development teams during security incidents involving applications, APIs, or CI/CD pipelines. 


• Support post-incident reviews to strengthen preventive controls across design, development, and deployment stages.
  
   

Application Security Testing and Tools:

• Support application-level investigations, including log analysis, attack-path validation, and exploitation assessment. 


• Leverage application security testing outputs (SAST, DAST, SCA) to correlate findings with real-world incidents. 


• Work with AppSec teams to validate exploitability of vulnerabilities identified during incidents. 


• Ensure application-level remediation actions are verified and tracked to closure.
  
   

Compliance and Governance:

• Ensure incident response processes align with industry standards and regulatory requirements (NIST, ISO 27001, company policies). 


• Maintain and update incident response SOPs, playbooks, and governance documentation. 


• Support audits and compliance reviews by providing incident evidence, metrics, and response effectiveness reports. 


• Track business unit adherence to incident remediation SLAs and governance requirements.

Incident Response and Threat Intelligence:

• Lead end-to-end incident response activities: detection, triage, containment, eradication, and recovery. 


• Work closely with SOC analysts in a 24x7 environment to validate alerts and escalate high-risk threats. 


• Perform hands-on investigations using SIEM, EDR, and forensic tools across endpoints, networks, and cloud environments. 


• Conduct malware analysis, log correlation, and threat hunting to identify advanced or persistent threats. 


• Integrate threat intelligence (IOCs, TTPs, MITRE ATT&CK mapping) into proactive detection and response improvements.

Training and Awareness:

• Mentor SOC analysts and junior incident responders on investigation techniques and response best practices. 


• Conduct incident response simulations, tabletop exercises, and post-incident knowledge-sharing sessions. 


• Drive continuous skill development across security operations teams. 


• Promote a strong incident response culture with accountability and learning focus.

Collaboration with Other Security Teams:

• Partner with SOC, Vulnerability Assessment, Network, Cloud, Application, and Infrastructure teams during incidents. 


• Coordinate endpoint-level remediation with IT and infrastructure teams to ensure timely closure. 


• Act as a central bridge between security operations and business units during crisis situations. 


• Foster cross-team collaboration while enforcing response and remediation accountability.

Tool Selection and Automation:

• Lead or influence selection and optimization of SIEM, EDR, SOAR, and forensic tools. 


• Identify opportunities to automate alert triage, incident enrichment, and response workflows. 


• Continuously improve tooling coverage and effectiveness based on incident feedback and threat evolution. 


• Ensure tools are tuned to reduce false positives while maintaining high detection accuracy.

Vendor and Third-Party Risk Management:

• Coordinate incident response activities involving third-party vendors or service providers. 


• Assess security incidents impacting vendors and evaluate downstream business risk. 


• Support remediation tracking and compliance verification for third-party incident-related actions. 


• Work with procurement and governance teams to incorporate incident response expectations into vendor engagements.
  
  
   

Non‑Negotiable & Role-Critical Requirements:

• 15–20 years of cybersecurity experience, with 5+ years in hands-on incident response and SOC operations.


• Proven leadership during high-severity, business-impacting security incidents.


• Strong, practical expertise in SIEM, EDR, malware analysis, and threat hunting.


• Deep understanding of network security, TCP/IP, cloud security, and modern attack techniques.


• Certifications such as GCIH, GCFA, or equivalent are mandatory.

On-site availability in Ahmedabad (no remote/hybrid flexibility).

Key Stakeholders - Internal: 

• Executive Leadership


• Department Heads


• System Administrators and Operations


• Internal Auditors 


• Legal and Compliance


• Security Awareness and Training Teams

Key Stakeholders - External:

• External Security Consultants


• Regulatory and Government Bodies


• Contractors and Service Providers


• Customers and Clients


• Insurance Providers 

Educational Background & Professional Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a closely related technical discipline.


• Advanced degree such as a Master’s or MBA in Cybersecurity, Information Assurance, Information Security, or Risk Management is preferred.


• Industry-recognized incident handling and response certifications such as GCIH, GCFA, GCIA, CEH, or CISSP.


• Additional SOC, Threat Hunting, and platform-specific certifications (SIEM, EDR, SOAR tools) are considered a strong advantage.


• Demonstrated proficiency in SIEM platforms, EDR solutions, and forensic analysis tools.


• Hands-on experience with malware analysis, log analysis, threat hunting, and incident investigations.


• Strong foundation in TCP/IP networking, network security architecture, and cloud security principles.

Working knowledge of leading security frameworks and methodologies, including NIST, MITRE ATT&CK, and ISO 27001.