Leadership and Strategy Development:

- Lead enterprise-wide cybersecurity incident response strategy, ensuring alignment with business objectives and organizational risk appetite.

- Act as the primary incident commander for high-severity (P1/P0) cybersecurity incidents, driving decisive action under pressure.

- Define and mature the organization’s incident response operating model, playbooks, escalation paths, and KPIs.

- Provide strategic guidance to SOC and security teams to improve detection fidelity, response efficiency, and resilience.

- Present incident posture, trends, and security maturity insights to senior leadership and executive stakeholders.

Risk Management:

- Assess and prioritize cybersecurity incidents based on business impact, threat severity, and operational risk.

- Ensure root cause analysis (RCA) is conducted post-incident to identify control gaps and systemic risks.

- Translate incident learnings into corrective and preventive actions, reducing recurrence risks.

- Support enterprise risk assessments by contributing incident data, threat trends, and exposure insights.

- Coordinate with business units to manage residual risk and track remediation to closure.

Secure Software Development Lifecycle (SDLC):

- Collaborate with application and product teams to integrate incident learnings into secure SDLC practices.

- Provide guidance on incident-driven improvements to secure coding, dependency management, and environment hardening.

- Engage with development teams during security incidents involving applications, APIs, or CI/CD pipelines.

- Support post-incident reviews to strengthen preventive controls across design, development, and deployment stages.

Application Security Testing and Tools:

- Support application-level investigations, including log analysis, attack-path validation, and exploitation assessment.

- Leverage application security testing outputs (SAST, DAST, SCA) to correlate findings with real-world incidents.

- Work with AppSec teams to validate exploitability of vulnerabilities identified during incidents.

- Ensure application-level remediation actions are verified and tracked to closure.

Compliance and Governance:

- Ensure incident response processes align with industry standards and regulatory requirements (NIST, ISO 27001, company policies).

- Maintain and update incident response SOPs, playbooks, and governance documentation.





- Support audits and compliance reviews by providing incident evidence, metrics, and response effectiveness reports.

- Track business unit adherence to incident remediation SLAs and governance requirements.

Incident Response and Threat Intelligence:

- Lead end-to-end incident response activities: detection, triage, containment, eradication, and recovery.

- Work closely with SOC analysts in a 24x7 environment to validate alerts and escalate high-risk threats.

- Perform hands-on investigations using SIEM, EDR, and forensic tools across endpoints, networks, and cloud environments.

- Conduct malware analysis, log correlation, and threat hunting to identify advanced or persistent threats.

- Integrate threat intelligence (IOCs, TTPs, MITRE ATT&CK; mapping) into proactive detection and response improvements.

Training and Awareness:

- Mentor SOC analysts and junior incident responders on investigation techniques and response best practices.

- Conduct incident response simulations, tabletop exercises, and post-incident knowledge-sharing sessions.

- Drive continuous skill development across security operations teams.

- Promote a strong incident response culture with accountability and learning focus.

Collaboration with Other Security Teams:

- Partner with SOC, Vulnerability Assessment, Network, Cloud, Application, and Infrastructure teams during incidents.

- Coordinate endpoint-level remediation with IT and infrastructure teams to ensure timely closure.

- Act as a central bridge between security operations and business units during crisis situations.

- Foster cross-team collaboration while enforcing response and remediation accountability.

Tool Selection and Automation:

- Lead or influence selection and optimization of SIEM, EDR, SOAR, and forensic tools.

- Identify opportunities to automate alert triage, incident enrichment, and response workflows.

- Continuously improve tooling coverage and effectiveness based on incident feedback and threat evolution.

- Ensure tools are tuned to reduce false positives while maintaining high detection accuracy.





Vendor and Third-Party Risk Management:

- Coordinate incident response activities involving third-party vendors or service providers.

- Assess security incidents impacting vendors and evaluate downstream business risk.

- Support remediation tracking and compliance verification for third-party incident-related actions.

- Work with procurement and governance teams to incorporate incident response expectations into vendor engagements.

Non‑Negotiable & Role-Critical Requirements:

- 15–20 years of cybersecurity experience, with 5+ years in hands-on incident response and SOC operations.

- Proven leadership during high-severity, business-impacting security incidents.

- Strong, practical expertise in SIEM, EDR, malware analysis, and threat hunting.

- Deep understanding of network security, TCP/IP, cloud security, and contemporary attack techniques.

- Certifications such as GCIH, GCFA, or equivalent are mandatory.

On-site availability in Ahmedabad (no remote/hybrid flexibility).

Key Stakeholders - Internal:

- Executive Leadership

- Department Heads

- System Administrators and Operations

- Internal Auditors

- Legal and Compliance

- Security Awareness and Training Teams

Key Stakeholders - External:

- External Security Consultants

- Regulatory and Government Bodies

- Contractors and Service Providers

- Customers and Clients

- Insurance Providers

Educational Background & Professional Qualifications:

- Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a closely related technical discipline.

- Advanced degree such as a Master’s or MBA in Cybersecurity, Information Assurance, Information Security, or Risk Management is preferred.

- Industry-recognized incident handling and response certifications such as GCIH, GCFA, GCIA, CEH, or CISSP.

- Additional SOC, Threat Hunting, and platform-specific certifications (SIEM, EDR, SOAR tools) are considered a strong advantage.

- Demonstrated proficiency in SIEM platforms, EDR solutions, and forensic analysis tools.

- Hands-on experience with malware analysis, log analysis, threat hunting, and incident investigations.

- Strong foundation in TCP/IP networking, network security architecture, and cloud security principles.

Working knowledge of leading security frameworks and methodologies, including NIST, MITRE ATT&CK;, and ISO 27001.

📌 Head - SOC Incident Response (Ahmedabad)
🏢 Adani
📍 Ahmedabad