Key responsibilities

- Own SOC operations across monitoring, investigation, incident response, detection engineering, threat hunting, platform coordination, and customer governance.

- Lead critical incidents as incident commander, ensure fact-based decisions and communications, and drive containment, recovery, root-cause analysis, and lessons learned.

- Define a platform-agnostic detection strategy across Google SecOps, Cortex XSIAM, Microsoft Sentinel, Splunk Enterprise Security, and other approved technologies.

- Govern use-case lifecycle, MITRE ATT&CK; coverage, telemetry priorities, content quality, tuning, automation, and acceptance testing.

- Manage analysts and leads through staffing, shifts, objectives, coaching, technical reviews, succession planning, training, and performance management.

- Own service levels, operational controls, audit readiness, risk management, customer escalations, third-party dependencies, and OEM support engagement.

- Review and communicate KPIs and KRIs covering MTTD, MTTR, SLA, incident quality, backlog, false positives, automation, coverage, and platform availability.

- Partner with engineering, CTI, threat hunting, vulnerability, IAM, endpoint, cloud,



and network teams to improve preventive and detective controls.

- Support SOC solutioning, transition, effort estimation, commercial assumptions, operating-model design, governance forums, and transformation roadmaps.

Essential qualifications and expertise

- 7-11 years of cybersecurity experience, including robust SOC/IR leadership and at least 2 years managing teams or enterprise security services.

- Demonstrated working knowledge of at least three leading enterprise SIEM platforms, with preferred platforms including Google Security Operations, Palo Alto Networks Cortex XSIAM, Microsoft Sentinel, and Splunk Enterprise Security.

- Strong command of incident management, detection engineering, SOAR, threat hunting, MITRE ATT&CK;, risk management, and security operations metrics.

- Excellent customer, executive, team-leadership, decision-making, negotiation, and written-communication skills.

Preferred qualifications

- CISSP, CISM, GIAC, OEM or comparable certifications.

- Experience with managed SOC transitions, multi-cloud security, regulatory audits, commercial solutioning, automation programs, and SOC maturity improvement.

📌 Walk-in || Deloitte_Walk-In Drive_Cyber_Gurgaon_ General SOC Manager (Delhi)
🏢 Deloitte Shared Services India
📍 Delhi