1. File integrity Monitoring & Cyber Security Incident Management

As part of this profile, the resource will perform the following:

Platform Management and Administration

- Administer and manage the NNT Change Tracker FIM, including deployment, configuration, troubleshooting, and ongoing platform optimization.
- Ensure platform health, availability, and secure operation across all POS machines.

Onboarding and offboarding

- Onboarding of POS machines based on the new store opening and PCI-scope countries
- Configuring the FIM rules
- Offboarding of agents based on the store closing request

Troubleshooting and Issue Resolution

- Monitor, identify, and resolve platform-related issues, including:
- Application and console functionality
- Communication with POS machines
- SIEM Integration
- Engage with support processes to address any anomalies that impact tool effectiveness.

Health Monitoring and Availability

- Continuously monitor the status and availability of all assets onboarded to the platform.
- Address failures or downtime to ensure uninterrupted detection coverage.

SOC Integration and Alerting

- Ensure effective integration between Canary and the Security Operations Center (SOC), including:
- Event forwarding to SIEM
- Alert correlation
- Escalation of alerts within SOC processes
- Validate alert quality and reduce false positives through periodic reviews.

Vendor Coordination

- Act as the main point of contact with the NNT Change Track vendor for:
- Technical support
- Issue resolution
- Product updates and enhancements
- Track and manage support tickets and ensure timely closure.

Access Management and Governance

- Manage user accounts and roles for the NNT change tracker management console.
- Conduct quarterly access reviews to validate access rights and enforce the principle of least privilege.

Documentation and SOP Maintenance

- Develop, maintain, and regularly update Standard Operating Procedures (SOPs) for:
- Agent deployment
- Incident response for alerts
- Platform maintenance and upgrade
- Integration workflows

Integration and Security Ecosystem Alignment

- Integrate Canary with other security platforms, such as:
- SIEM
- Threat intelligence systems
- Incident response and ticketing platforms
- Ensure deception data enriches MAF's overall security monitoring and detection framework.





Business Continuity and Disaster Recovery

- Develop, maintain, and periodically test BC/DR plans for the NNT platform and related assets.
- Validate platform recovery capabilities in the event of disruption or attack.
- Incident Sources Covered
- Monitor, integrate, and respond to incidents originating from, the following sources:
- Akamai Web Application Firewall (WAF)
- Extended Detection and Response (XDR) Managed Services (e.g., CrowdStrike)
- Endpoint Detection and Response (EDR) solutions
- Bug Bounty and Vulnerability Disclosure Platforms (e.g., Bugcrowd)
- Security Operations Center (SOC) alerts (from SIEM/SOAR platforms)
- Threat Intelligence Feeds (e.g., Anomali, vendor advisories)
- Internal User and Business Reporting Channels
- Application Performance Monitoring (APM) alerts (e.g., Current Relic)

General Service Requirements

- Demonstrate a thorough understanding of cybersecurity incident management and align with industry best practices.
- Ensure immediate and appropriate response to incidents according to predefined severity levels and Incident Management Processes.
- Investigate incidents thoroughly, document actions taken, and comply with reporting requirements.
- Retain all records and logs related to security incidents and investigations.
- Implement corrective and preventive measures based on the incident's root cause.
- Support incident detection and alerting from Retail-specific APM tools (e.g., New Relic), ensuring coordination between development, application, and security teams.
- Standardize incident handling processes through documented playbooks.
- Coordinate incident resolution actions across IT, application, and infrastructure teams, ensuring closure within agreed SLAs.
- Support internal investigations led by MAF (Majid Al Futtaim) teams as required.
- Review and recommend enhancements to SOC use cases for better detection capabilities.




- Support and manage related ticket types including LSM (Log Source Management), SCM (Security Configuration Management), and Threat Intelligence Tickets.

Detection & Intake

- Continuously monitor and collect security events from all listed sources.
- Validate and normalize alerts, eliminating false positives to focus on genuine incidents.

Initial Analysis & Triage

- Confirm the authenticity of reported incidents.
- Determine the nature, origin, and threat actor behaviour.
- Categorize incidents based on their potential impact and urgency.

Severity Classification

- Assign severity levels (e.g., P1, P2, P3) based on predefined business impact criteria, data sensitivity, and operational risk.
- Ensure P1 incidents are treated as high-priority events requiring immediate containment and escalation.
- Follow the agreed severity classification framework for consistency.

Incident Containment

- Execute immediate containment actions such as isolating compromised systems, blocking malicious traffic, or disabling compromised accounts.
- Recommend and coordinate appropriate mitigation steps with responsible technical teams.

Escalation & Coordination

- Initiate a "War Room" (bridge call) for all P1 incidents to ensure rapid response coordination.
- Engage relevant stakeholders, including BISO (Business Information Security Officer), system owners, and impacted business units.
- Maintain continuous real-time status updates and detailed documentation during the incident lifecycle.

Remediation Support

- Provide guidance on necessary remediation actions to relevant IT teams.
- Ensure full eradication of Indicators of Compromise (IoCs).
- Coordinate activities such as patching, system hardening, and control implementations where necessary.

Communication & Updates

- Deliver timely incident status updates to stakeholders.
- Document all incident actions, decisions, and timelines within the incident management and tracking platforms.

Post-Incident Analysis & RCA

- Conduct Root Cause Analysis (RCA) for all P1 incidents and select significant P2 incidents.
- Identify underlying security gaps and propose improvement recommendations.
- Produce a formal RCA report with detailed findings, lessons learned, and corrective action plans.

Roles and Responsibilities

FIM/File integrity Monitoring

📌 TECHNICAL LEAD - SOC 2 (Bengaluru)
🏢 Happiest Minds Technologies
📍 Bengaluru