Job Description
• File integrity Monitoring & Cyber Security Incident Management As part of this profile, the resource will perform the following: Platform Management and Administration
• Administer and manage the NNT Change Tracker FIM, including deployment, configuration, troubleshooting, and ongoing platform optimization.
• Ensure platform health, availability, and secure operation across all POS machines. Onboarding and offboarding
• Onboarding of POS machines based on the new store opening and PCI-scope countries
• Configuring the FIM rules
• Offboarding of agents based on the store closing request Troubleshooting and Issue Resolution
• Monitor, identify, and resolve platform-related issues, including:
• Application and console functionality
• Communication with POS machines
• SIEM Integration
• Engage with support processes to address any anomalies that impact tool effectiveness. Health Monitoring and Availability
• Continuously monitor the status and availability of all assets onboarded to the platform.
• Address failures or downtime to ensure uninterrupted detection coverage. SOC Integration and Alerting
• Ensure effective integration between Canary and the Security Operations Center (SOC), including:
• Event forwarding to SIEM
• Alert correlation
• Escalation of alerts within SOC processes
• Validate alert quality and reduce false positives through periodic reviews. Vendor Coordination
• Act as the main point of contact with the NNT Change Track vendor for:
• Technical support
• Issue resolution
• Product updates and enhancements
• Track and manage support tickets and ensure timely closure. Access Management and Governance
• Manage user accounts and roles for the NNT change tracker management console.
• Conduct quarterly access reviews to validate access rights and enforce the principle of least privilege. Documentation and SOP Maintenance
• Develop, maintain, and regularly update Standard Operating Procedures (SOPs) for:
• Agent deployment
• Incident response for alerts
• Platform maintenance and upgrade
• Integration workflows Integration and Security Ecosystem Alignment
• Integrate Canary with other security platforms, such as:
• SIEM
• Threat intelligence systems
• Incident response and ticketing platforms
• Ensure deception data enriches MAF's overall security monitoring and detection framework.



Business Continuity and Disaster Recovery
• Develop, maintain, and periodically test BC/DR plans for the NNT platform and related assets.
• Validate platform recovery capabilities in the event of disruption or attack.
• Incident Sources Covered
• Monitor, integrate, and respond to incidents originating from, the following sources:
• Akamai Web Application Firewall (WAF)
• Extended Detection and Response (XDR) Managed Services (e.g., CrowdStrike)
• Endpoint Detection and Response (EDR) solutions
• Bug Bounty and Vulnerability Disclosure Platforms (e.g., Bugcrowd)
• Security Operations Center (SOC) alerts (from SIEM/SOAR platforms)
• Threat Intelligence Feeds (e.g., Anomali, vendor advisories)
• Internal User and Business Reporting Channels
• Application Performance Monitoring (APM) alerts (e.g., Recent Relic) General Service Requirements
• Demonstrate a thorough understanding of cybersecurity incident management and align with industry best practices.
• Ensure immediate and appropriate response to incidents according to predefined severity levels and Incident Management Processes.
• Investigate incidents thoroughly, document actions taken, and comply with reporting requirements.
• Retain all records and logs related to security incidents and investigations.
• Implement corrective and preventive measures based on the incident's root cause.
• Support incident detection and alerting from Retail-specific APM tools (e.g., New Relic), ensuring coordination between development, application, and security teams.
• Standardize incident handling processes through documented playbooks.
• Coordinate incident resolution actions across IT, application, and infrastructure teams, ensuring closure within agreed SLAs.
• Support internal investigations led by MAF (Majid Al Futtaim) teams as required.
• Review and recommend enhancements to SOC use cases for better detection capabilities.
• Support and manage related ticket types including LSM (Log Source Management), SCM (Security Configuration Management),



and Threat Intelligence Tickets. Detection & Intake
• Continuously monitor and collect security events from all listed sources.
• Validate and normalize alerts, eliminating false positives to focus on genuine incidents. Initial Analysis & Triage
• Confirm the authenticity of reported incidents.
• Determine the nature, origin, and threat actor behaviour.
• Categorize incidents based on their potential impact and urgency. Severity Classification
• Assign severity levels (e.g., P1, P2, P3) based on predefined business impact criteria, data sensitivity, and operational risk.
• Ensure P1 incidents are treated as high-priority events requiring immediate containment and escalation.
• Follow the agreed severity classification framework for consistency. Incident Containment
• Execute immediate containment actions such as isolating compromised systems, blocking malicious traffic, or disabling compromised accounts.
• Recommend and coordinate appropriate mitigation steps with responsible technical teams. Escalation & Coordination
• Initiate a "War Room" (bridge call) for all P1 incidents to ensure rapid response coordination.
• Engage relevant stakeholders, including BISO (Business Information Security Officer), system owners, and impacted business units.
• Maintain continuous real-time status updates and detailed documentation during the incident lifecycle. Remediation Support
• Provide guidance on necessary remediation actions to relevant IT teams.
• Ensure full eradication of Indicators of Compromise (IoCs).
• Coordinate activities such as patching, system hardening, and control implementations where necessary. Communication & Updates
• Deliver timely incident status updates to stakeholders.
• Document all incident actions, decisions, and timelines within the incident management and tracking platforms. Post-Incident Analysis & RCA
• Conduct Root Cause Analysis (RCA) for all P1 incidents and select significant P2 incidents.
• Identify underlying security gaps and propose improvement recommendations.
• Produce a formal RCA report with detailed findings, lessons learned, and corrective action plans. File integrity Monitoring,Cyber Security Incident Management,Qradar,FIM/File integrity Monitoring,NNT Change Tracker FIM,Platform Management and Administration,CrowdStrike,WAF,Bugcrowd,Anomali,Application Performance and Monitoring

📌 SENIOR ENGINEER (Bengaluru)
🏢 Happiest Minds Technologies
📍 Bengaluru