Job Summary

The candidate ensures that the risk to the organization’s information posed by a variety of cyber threats (cyber-attacks; theft or corruption from within; etc.) is minimized through immediate Situation Management. Candidate in this role will function as subject matter expertise within the discipline of Situation Management w.r.t . Incident Response through Coordination, Collaboration, Escalation from Cyber Security risk standpoint. Role will require building and maintaining working relationships with multiple business units, information technology teams, and engaging with various levels of senior management. Candidates in this role will also be expected to possess the technical aptitude necessary to understand the IT security tools, vulnerabilities and current threat landscape.

Candidates will need to establish and maintain positive and productive relationships through ongoing dialogue with department direct reports, technical leads, internal business partners, senior management, and other interested parties. He/she will report status, manage issues and mitigate risks, escalating issues/risks to upper management as appropriate.

Key Responsibilities

• Handling critical incidents/escalations, reviewing incidents and tracking towards closure also Initiate (P1,P2,P3) to coordinate & collaborate within the technical tracks to look for a remediation solution for a security incident.
• Participate in setting up the policies, practices, and procedures for incident command center/ situation management.
• Understand the security incident and take necessary actions to coordinate with respective stakeholders to remediate the incident in the defined SLA. Good to have knowledge of Security Tools (SEIM, Crowd Strike, and endpoint protection).
• Develop and maintain incident response playbooks and runbooks. Train teams on incident handling procedures and communication protocols.
• Coordinate forensic analysis, intrusion detection, and threat mitigation.
• Work with various teams including business, technical, administrative to identify the Root Cause of the Problem / incident and work with them to apply the remediation to resolve the incident immediately.
• Take necessary actions to coordinate through collaboration tools (Emails, calls, chat etc.) and work with various business and technical teams to resolve the incident in the defined timelines.
• Host/Lead incident calls with active participation, ask prompting questions, maintain incident meeting notes, publish actions, resolutions etc.
• Publish Incident reports during and after the Situation Management. Work closely with various platforms / tools (Windows, Network / Security etc.) and business owners to resolve the incident and capture action items.
• Block Malicious IPs, Domains, SHA values, Reset Passwords and Kill MFA sessions. Un- contain/ Contain the machines through different tools.
• Continuously evolve IT Service Management (ITSM) practices for an effective Incident Response.
• Manage Cyber Crisis Response and work with various supporting functions (Legal, HR, Finance, Procurement, Physical security, Privacy, R&C, Insurance Company, Treat Intel Provider etc.) to take necessary reactive / corrective actions as per defined Incident Response Plan (IRP).

Skill Requirements

Other Requirements