Head - SOC Incident Response

Head - SOC Incident Response

Leadership and Strategy Development:

• Lead enterprise-wide cybersecurity incident response strategy, ensuring alignment with business objectives and organizational risk appetite. 
• Act as the primary incident commander for high-severity (P1/P0) cybersecurity incidents, driving decisive action under pressure. 
• Define and mature the organization’s incident response operating model, playbooks, escalation paths, and KPIs. 
• Provide strategic guidance to SOC and security teams to improve detection fidelity, response efficiency, and resilience. 
• Present incident posture, trends, and security maturity insights to senior leadership and executive stakeholders.
  

Risk Management:

• Assess and prioritize cybersecurity incidents based on business impact, threat severity, and operational risk. 
• Ensure root cause analysis (RCA) is conducted post-incident to identify control gaps and systemic risks. 
• Translate incident learnings into corrective and preventive actions, reducing recurrence risks. 
• Support enterprise risk assessments by contributing incident data, threat trends, and exposure insights. 
• Coordinate with business units to manage residual risk and track remediation to closure.

Secure Software Development Lifecycle (SDLC):

• Collaborate with application and product teams to integrate incident learnings into secure SDLC practices. 
• Provide guidance on incident-driven improvements to secure coding, dependency management, and environment hardening. 
• Engage with development teams during security incidents involving applications, APIs, or CI/CD pipelines. 
• Support post-incident reviews to strengthen preventive controls across design, development, and deployment stages.
  

Application Security Testing and Tools:

• Support application-level investigations, including log analysis, attack-path validation, and exploitation assessment. 
• Leverage application security testing outputs (SAST, DAST, SCA) to correlate findings with real-world incidents. 
• Work with AppSec teams to validate exploitability of vulnerabilities identified during incidents. 
• Ensure application-level remediation actions are verified and tracked to closure.
  

Compliance and Governance:

• Ensure incident response processes align with industry standards and regulatory requirements (NIST, ISO 27001, company policies). 
• Maintain and update incident response SOPs, playbooks, and governance documentation. 
• Support audits and compliance reviews by providing incident evidence, metrics, and response effectiveness reports. 
• Track business unit adherence to incident remediation SLAs and governance requirements.

Incident Response and Threat Intelligence:

• Lead end-to-end incident response activities: detection, triage, containment, eradication, and recovery. 
• Work closely with SOC analysts in a 24x7 environment to validate alerts and escalate high-risk threats. 
• Perform hands-on investigations using SIEM, EDR, and forensic tools across endpoints, networks, and cloud environments. 
• Conduct malware analysis, log correlation, and threat hunting to identify advanced or persistent threats. 
• Integrate threat intelligence (IOCs, TTPs, MITRE ATT&CK mapping) into proactive detection and response improvements.

Training and Awareness:

• Mentor SOC analysts and junior incident responders on investigation techniques and response best practices. 
• Conduct incident response simulations, tabletop exercises, and post-incident knowledge-sharing sessions. 
• Drive continuous skill development across security operations teams. 
• Promote a strong incident response culture with accountability and learning focus.

Collaboration with Other Security Teams:

• Partner with SOC, Vulnerability Assessment, Network, Cloud, Application, and Infrastructure teams during incidents. 
• Coordinate endpoint-level remediation with IT and infrastructure teams to ensure timely closure. 
• Act as a central bridge between security operations and business units during crisis situations. 
• Foster cross-team collaboration while enforcing response and remediation accountability.

Tool Selection and Automation:

• Lead or influence selection and optimization of SIEM, EDR, SOAR, and forensic tools. 
• Identify opportunities to automate alert triage, incident enrichment, and response workflows. 
• Continuously improve tooling coverage and effectiveness based on incident feedback and threat evolution. 
• Ensure tools are tuned to reduce false positives while maintaining high detection accuracy.

Vendor and Third-Party Risk Management:

• Coordinate incident response activities involving third-party vendors or service providers. 
• Assess security incidents impacting vendors and evaluate downstream business risk. 
• Support remediation tracking and compliance verification for third-party incident-related actions. 
• Work with procurement and governance teams to incorporate incident response expectations into vendor engagements.
  
  

Non‑Negotiable & Role-Critical Requirements:

• 15–20 years of cybersecurity experience, with 5+ years in hands-on incident response and SOC operations.
• Proven leadership during high-severity, business-impacting security incidents.
• Strong, practical expertise in SIEM, EDR, malware analysis, and threat hunting.
• Deep understanding of network security, TCP/IP, cloud security, and modern attack techniques.
• Certifications such as GCIH, GCFA, or equivalent are mandatory.

On-site availability in Ahmedabad (no remote/hybrid flexibility).

Key Stakeholders - Internal: 

• Executive Leadership
• Department Heads
• System Administrators and Operations
• Internal Auditors 
• Legal and Compliance
• Security Awareness and Training Teams

Key Stakeholders - External:

• External Security Consultants
• Regulatory and Government Bodies
• Contractors and Service Providers
• Customers and Clients
• Insurance Providers 

Educational Background & Professional Qualifications:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a closely related technical discipline.
• Advanced degree such as a Master’s or MBA in Cybersecurity, Information Assurance, Information Security, or Risk Management is preferred.
• Industry-recognized incident handling and response certifications such as GCIH, GCFA, GCIA, CEH, or CISSP.
• Additional SOC, Threat Hunting, and platform-specific certifications (SIEM, EDR, SOAR tools) are considered a strong advantage.
• Demonstrated proficiency in SIEM platforms, EDR solutions, and forensic analysis tools.
• Hands-on experience with malware analysis, log analysis, threat hunting, and incident investigations.
• Strong foundation in TCP/IP networking, network security architecture, and cloud security principles.

Working knowledge of leading security frameworks and methodologies, including NIST, MITRE ATT&CK, and ISO 27001.

Experience Level

Executive Level