Job Summary The L3 Security Specialist / Incident Response Lead acts as the highest technical escalation point for critical complex security incidents in the 24x7 CERT service model. This role is responsible for advanced threat investigation, technical leadership during severe incidents, scoping of impact, specialist analysis, strategic containment advice, improvement of runbooks/detections, support to service governance for major security risks. The role also acts as a technical mentor for L1/L2 teams helps strengthen operational maturity over time.

Key Responsibilities

- Lead Technical Investigation of Complex, High-Severity, or Escalated Security Incidents Beyond Standard L2 Analysis

- Perform Advanced Incident Scoping to Determine Extent of Compromise, Impacted Systems/Accounts, Attack Sequence, Likely Threat Progression

- Review Escalations Involving Suspicious Privileged Activity, Repeated Compromise Patterns, Container/Runtime Anomalies, High-Risk Infrastructure Alerts, or Evidence of Coordinated Attack Behavior

- Provide Expert-Level Containment Remediation Recommendations Based on Risk, Business Criticality, Threat Behavior, Operational Constraints

- Support High-Priority Incident Communications by Translating Technical Findings into Structured Stakeholder-Ready Updates

- Work Closely with Internal Resolver Groups, Infrastructure/Application Owners, Incident Managers, Service Management Stakeholders During Critical Investigations

- Identify Systemic Weaknesses Recurring Root Causes, Recommend Longer-Term Improvements in Detection Use Cases, Process Maturity, SOPs, Playbooks, Escalation Models

- Guide Security Analysts on Advanced Analysis Methods, Evidence Handling, Incident Scoping, Response Decision-Making





- Participate in Weekly Incident Reviews, Monthly Governance Reporting, Continuous Service Improvement Discussions with a Strong Focus on Risk Trends Service Resilience

- Strengthen Knowledge Management Through Development of Advanced Use Cases, Threat Investigation Patterns, Specialized Runbooks, Lessons Learned Documentation

Required Technical Skills

- Deep Expertise in Incident Response, Advanced Threat Investigation, Attack Analysis, Containment Strategy, Operational Decision-Making in Live Incidents

- Strong Experience with SIEM/SOAR Platforms, Especially Investigation Workflows, Offense Analysis, Data Correlation, High-Fidelity Case Handling

- Strong Understanding of Security Telemetry Across Logs, Authentication Systems, Network Activity, Endpoint Behavior, Container/Runtime Monitoring, Threat Advisories

- Ability to Assess Business Impact vs Technical Severity Advise on Containment Actions Without Losing Sight of Continuity Requirements

- Robust Knowledge of Incident Lifecycle Management, Escalation Governance, Reporting, Knowledge Management, Service Improvement Practices

- Ability to Write Clear Executive Technical Summaries for Senior Stakeholders Operational Teams

Required Experience / Qualification

- Bachelors Degree in Cybersecurity, Computer Science, Information Security, or Related Field Preferred

- Typically 610+ Years of Experience in Incident Response, CERT/SOC Engineering, Advanced Threat Analysis, or Senior Security Operations Roles

- Proven Experience Handling Critical/High-Severity Security Investigations Guiding Cross-Functional Technical Response

- Certifications such as GCIA, GCIH, GCFA, CISSP, SC-200, Vendor SIEM Certifications, or Equivalent Advanced Credentials would be Advantageous

📌 Security Product Architect (Bengaluru)
🏢 VOLKSWAGEN GROUP DIGITAL SOLUTIONS PRIVATE
📍 Bengaluru