Role & responsibilities

- Lead and manage the Security Operations Center (SOC) and day-to-day cybersecurity operations.
- Develop and execute the organization's security operations strategy, processes, policies, and procedures.
- Monitor security events, alerts, logs, endpoints, networks, cloud environments, and applications to identify potential threats.
- Oversee security incident detection, investigation, response, containment, eradication, and recovery.
- Establish and monitor SOC SLAs, KPIs, security metrics, and operational performance.
- Lead the response to cybersecurity incidents, breaches, malware attacks, phishing, ransomware, unauthorized access, and other security threats.
- Manage and optimize SIEM, SOAR, EDR/XDR, vulnerability management, threat intelligence, and security monitoring platforms.
- Develop and maintain effective incident response, threat detection, escalation, and crisis management procedures.
- Conduct regular vulnerability assessments, threat assessments, security reviews, and risk evaluations.
- Coordinate with IT infrastructure, cloud, application, network, DevOps, compliance, and business teams to remediate security risks.
- Establish security controls and processes aligned with frameworks such as NIST, ISO 27001, CIS Controls, and MITRE ATT&CK.;
- Manage cybersecurity vendors, managed security service providers (MSSPs), contracts, tools, and security operations budgets.
- Ensure effective security logging, monitoring, reporting, evidence collection, and incident documentation.
- Conduct security drills, tabletop exercises, incident simulations,



and continuous improvement initiatives.
- Prepare regular security posture, incident, risk, and compliance reports for senior management.
- Ensure security operations comply with applicable regulatory, privacy, audit, and organizational requirements.
- Recruit, mentor, and develop security analysts, engineers, incident responders, and other SOC personnel.
- Stay current with emerging cyber threats, attack techniques, vulnerabilities, security technologies, and industry best practices.

Preferred candidate profile

- 5 to 10 years of experience in cybersecurity, security operations, SOC, incident response, or information security, including experience in a leadership or supervisory capacity.
- Proven experience managing SOC/security operations teams and cybersecurity incidents.
- Strong hands-on understanding of SIEM, SOAR, EDR/XDR, threat detection, incident response, vulnerability management, and threat intelligence.
- Experience with platforms such as Microsoft Sentinel, Splunk, IBM QRadar, CrowdStrike, Microsoft Defender, Palo Alto, or equivalent security technologies.
- Strong understanding of network security, endpoint security, cloud security, IAM, firewalls, encryption,



application security, and security architecture.
- Experience investigating and responding to malware, phishing, ransomware, data breaches, privilege escalation, and unauthorized access incidents.
- Strong knowledge of cybersecurity frameworks including NIST, ISO 27001, CIS Controls, and MITRE ATT&CK.;
- Experience with security automation, threat hunting, vulnerability management, security analytics, and incident-response processes.
- Robust understanding of risk management, security governance, compliance, audit requirements, and security policies.
- Experience managing security vendors, MSSPs, security tools, budgets, SLAs, and third-party relationships.
- Strong leadership skills with experience building, mentoring, and managing SOC analysts and cybersecurity professionals.
- Excellent incident management, crisis management, analytical thinking, problem-solving, communication, and stakeholder-management skills.
- Ability to work effectively under pressure and make timely decisions during critical security incidents.
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Information Security, Computer Engineering, or a related field.
- Relevant certifications such as CISSP, CISM, CRISC, CEH, GIAC, Security+, ISO 27001, or cloud-security certifications are desirable.
- Experience with 247 SOC operations, global security environments, or regulated industries such as BFSI, healthcare, telecom, or government is an advantage.

📌 Security Operations Manager (India)
🏢 Good Co India
📍 India