- Job ID: 854085

- 5 - 10 Years

- 1 Opening
- Bengaluru

Role description

We are seeking a highly motivated and strategic SOC Manager to lead and mature our global 24x7 Security Operations Center. In this pivotal role, you will act as the bridge between high-level business priorities and technical execution, overseeing a unified defense strategy across internal teams and MSSP partners. You will be responsible for the operational oversight and continuous improvement of our security posture, with a focused emphasis on maximizing our CrowdStrike MDR partnership. By ensuring that Falcon telemetry, Proofpoint email security, and Palo Alto network defenses seamlessly integrate with internal workflows, you will provide comprehensive protection for the enterprise around the clock.

This role is hands-on and operational. The ideal candidate should have strong experience in security investigations and incident response, and can coach, mentor and guide the junior analysts during high-severity events. You will help improve incident response capabilities through practical experience and collaboration with Red, Blue, and Purple Teams. The position requires comfort working in a 24x7 shift-based environment, including leading major incident calls and handling escalations when needed. Your mission is to provide threat hunting and bring threat intelligence into clear actions that protect the business at all times.

Skills

Primary Responsibilities

SOC Operations & Security Monitoring

Lead day-to-day 24x7 SOC operations

Oversee monitoring and investigation across:

CrowdStrike MDR / Falcon (SIEM, EDR, threat telemetry)

Proofpoint (Email security, phishing analysis, TAP s)

Palo Alto Firewalls (network s, session monitoring, threat prevention)

Ensure timely triage, classification, and escalation of s based on severity and business impact.

Validate MDR escalations and ensure alignment with internal response playbooks.

Correlate events across endpoint, email, network, and cloud telemetry to detect attack patterns and lateral movement.

Ensure proper logging retention standards are implemented and maintained.

Incident Response Leadership & Escalation

Ensure implementation, maintenance, and continuous improvement of the Cybersecurity Incident Response Plan (CIRP).

Lead investigation of high-priority and critical security incidents.

Coordinate response activities across IT, infrastructure, business units, Legal, HR, and Compliance.

Oversee containment, eradication, recovery, and post-incident review.

Ensure Root Cause Analysis (RCA) reports are completed for major incidents.

Provide escalation advisory and executive-ready summaries during major events.

Phishing,



Email Security & Brand Protection Oversight

Oversee phishing investigations and campaign-level analysis using Proofpoint.

Approve blocking of malicious IPs, URLs, domains, and sender IDs.

Monitor large-scale phishing or impersonation campaigns and coordinate mitigation strategy.

Ensure Content Search & Purge processes are executed when required.

Threat Intelligence & Proactive Defense

Guide intelligence-driven threat hunting using TTP-based methodologies.

Lead proactive threat hunting using CrowdStrike telemetry and SIEM datasets.

Recommend improvements to incident classification matrix and severity assignment.

Collaborate with red/purple teams to validate detection capabilities and improve playbooks.

Firewall & Network Security Oversight (Palo Alto)

Oversee investigation of firewall s including session limit events, scanning attempts, and exploit activity.

Coordinate appropriate blocking on Palo Alto.

Coordinate with network teams for DoS policy tuning and traffic validation.

Monitor for suspicious ingress/egress traffic patterns and unauthorized access attempts.

Process, Documentation & Compliance

Oversee development and quarterly updates of operational runbooks.

Ensure SOC processes align with regulatory frameworks (ISO 27001, NIST, SOC 2, etc.).

Review and approve runbooks within defined timelines.

Support internal and external audits with timely documentation and evidence.

Reporting & Executive Communication

Deliver daily, weekly, and monthly SOC performance reports as directed.

Provide business-focused summaries on major incidents and emerging threats.

Translate technical findings into clear, executive-level impact statements.

Provide trend analysis across endpoint, email, and network security domains.

Key Expectations

Operate effectively in a 24x7 shift-based security environment.

Lead by example during high-pressure incidents.

Ensure consistent, high-quality incidents handling across all technologies.

Continuously improve detection, response, and operational maturity.

Serve as the escalation point for complex technical and operational security matters.

Other details

Required Qualifications

Experience

5–8+ years in security operations, incident response, or threat detection.

2–4 years in a SOC or IR role, with at least 2 years in a leadership or team‑lead capacity.





Hands‑on experience with SIEM platforms (CrowdStrike MDR), Proofpoint, EDR tools (CrowdStrike, Defender for Endpoint), and network security monitoring.

Technical Skills

Strong understanding of attack techniques and threat actor behaviors (MITRE ATT&CK;).

Experience with log analysis, packet capture tools, and forensic techniques.

Basic scripting skills preferred (PowerShell, Python) for automation and investigation tasks.

Familiarity with cloud security, identity telemetry, and modern detection strategies.

Certifications (Preferred)

CompTIA Security+, CySA+, GCIA, GCIH, or equivalent.

CrowdStrike certifications (CCFA, CCFR, CCFH) are a plus.

Exposure to Red/Blue/Purple Team methodologies is beneficial.

Preferred Attributes

CrowdStrike certifications (CCFA, CCFR, CCFH).

Experience with SOAR platforms, SIEM tools, and cloud security monitoring.

Strong Incident analysis and reporting skills is a must.

Ability to work effectively in a fast‑paced, 24x7 SOC setting.

Excellent communication, leadership, and documentation skills.

Ability to translate technical findings into business‑relevant insights.

About Grant Thornton INDUS

‘Grant Thornton INDUS’ comprises GT U.S. Shared Services Center India Pvt Ltd and Grant Thornton U.S. Knowledge and Capability Center India Pvt Ltd. Grant Thornton INDUS is the shared services center supporting the operations of Grant Thornton LLP, the U.S. member firm of Grant Thornton International Ltd. Established in 2012, Grant Thornton INDUS employs professionals across a wide range of disciplines including Tax, Audit, Advisory, and other operational functions. What sets us apart isn’t just what we do – it’s how we do it. We support and enable the firm’s purpose of making business more personal and building trust into every result. We’re collaborators – obsessed with quality and ready for anything – who understand the value of strong relationships. Our professionals are well integrated to seamlessly support the U.S. engagement teams, help increase Grant Thornton’s access to a wide talent pool, and improve operational efficiencies. Empowered people, bold leadership, and distinctive client service are imbibed in the culture at Grant Thornton INDUS. We are a transparent, competitive, and excellence-driven firm that offers an opportunity to be part of something significant. In addition, professionals at Grant Thornton INDUS serve communities in India through inspirational and generous services to give back to the communities they work in. Grant Thornton INDUS has its offices in two locations in India – Bengaluru and Kolkata

📌 Security Operations Center (SOC) Manager (India)
🏢 Grant Thornton INDUS
📍 India