SISA Information Security - Security Operations Center Manager - SIEM/SOAR

Role Overview : We are seeking a highly experienced and technically strong SOC Manager to lead and evolve our Security Operations Center into a mature, engineering-driven, and outcome-focused capability in the AI driven world. This Role Requires a Hybrid Leader Who Can : - Drive 24x7 SOC operations excellence. - Own SIEM/SOAR engineering & detection lifecycle. - Collaborate closely with Product & Development teams. - Influence platform enhancements through operational intelligence. - Build and mentor high-performing security teams. - Highlight risks and gaps in logging methodologies. - Improve security posture across multi-tenant cloud and on-prem environments. Key Responsibilities : SOC Operations Leadership & Incident Governance : - Lead 24x7 SOC operations including detection, triage, escalation, containment, and recovery. - Serve as final escalation point (L3/L4) for complex and high-severity incidents. - Define and enforce incident response lifecycle aligned with NIST, ISO 27001, and MITRE ATT&CK. - Ensure adherence to SLA / OLA targets (MTTA, MTTR, containment time). - Conduct executive-level incident briefings and publish detailed RCA reports. - Ensure compliance with organizational security policies and audit requirements. - Oversee case quality assurance and investigation standards. SOC Engineering & Detection Engineering : - Own SIEM/SOAR architecture optimization and performance tuning. - Lead log onboarding strategy (cloud, on-prem, hybrid environments). - Ensure proper log normalization, parsing, enrichment, and correlation. - Drive full detection use-case lifecycle : 1. Threat modelling. 2. Use-case creation. 3. Validation & tuning. 4. Performance measurement. 5. Decommissioning of ineffective rules. - Reduce alert fatigue through risk-based alerting, contextual enrichment, and behavioural analytics. - Implement detection-as-code practices with version-controlled rule management. - Ensure high ingestion performance and scalable log retention strategies. Threat Hunting & Advanced Analysis : - Establish and lead proactive threat hunting programs. - Map detection coverage against MITRE ATT&CK framework. - Perform advanced investigations including: 1. Packet capture analysis. 2. Endpoint telemetry analysis. 3. Log correlation across multiple data sources. - Integrate threat intelligence feeds and manage IOC lifecycle. - Identify emerging attack patterns and update detection coverage accordingly. Product Engineering & Platform Enhancement Ownership : - Act as the primary SOC liaison for Product and Engineering teams. - Translate operational pain points into structured enhancement requirements. - Maintain and prioritize a backlog of platform improvements. - Provide structured feedback on: 1. Detection gaps. 2. Alert noise. 3. Data ingestion latency. 4. Query performance issues. 5. UX inefficiencies impacting analysts. - Participate in sprint planning and architecture discussions and provide inputs for enhancements. - Be part of pilot validation of new features prior to production release. - Quantify impact of enhancements (false positive & incident reduction %, MTTR improvement, automation coverage growth). Client Onboarding & Security Architecture Oversight : - Lead secure onboarding of customers across: 1. AWS / Azure / GCP. 2. On-prem data centers. 3. Hybrid architectures. - Conduct log gap assessments and telemetry validation. - Align detection coverage to client risk profiles. - Participate in customer governance calls and QBRs. - Provide architectural recommendations to improve customer security posture. Team Leadership & Capability Development : - Lead, mentor, and manage L1/L2/L3 analysts. - Establish skill matrix and structured career progression roadmap. - Conduct periodic case audits and performance reviews. - Develop training programs in: 1. Advanced detection engineering. 2. Threat hunting. 3. Forensics. 4. Automation. - Drive hiring, onboarding, and succession planning. - Build a high-performance, accountability-driven culture. Metrics, Reporting & Continuous Improvement : - Define and monitor SOC KPIs: 1. MTTA / MTTR. 2. False positive ratio. 3. Detection accuracy. 4. Automation coverage. 5. Incident recurrence rate & reasoning. - Publish monthly executive dashboards. - Conduct quarterly SOC maturity assessments. - Drive continuous improvement roadmap aligned with business growth. Mandatory Technical Skills : - 10-12 years of cybersecurity experience. - Minimum 4 - 5 years in SOC Lead / SOC Manager role. - Strong hands-on experience in at least one SIEM platform: 1. Splunk / Sentinel / QRadar / Elastic / AlienVault / DNIF / McAfee ESM. - Experience implementing SOAR automation. - Deep understanding of: 1. Network security (Firewall, IDS/IPS, WAF). 2. EDR/XDR platforms. 3. Cloud security (AWS, Azure). 4. Identity & Access Management. - Strong knowledge of : 1. MITRE ATT&CK & Defend. 2. NIST & NIST IR Framework. 3. Defense-in-Depth architecture. - Experience with query writing and log analysis on SIEM technologies. Preferred Technical & Engineering Skills : - Scripting (Python / PowerShell / Bash) would be added advantage. - Exposure to DevSecOps environments. - Knowledge of container and Kubernetes, cloud security. - Data analytics for anomaly detection. - Familiarity with compliance frameworks : 1. ISO 27001. 2. SOC 2. 3. PCI-DSS. 4. HIPAA. Certifications (Preferred) : - CISSP / CISM. - CEH. - CompTIA Security+. - GIAC Certifications (GCIA / GCIH / GCED). - Cloud Security Certifications (AWS / Azure / GCP/ Oracle). Leadership Competencies : - Strong executive communication and stakeholder management. - Ability to manage high-pressure incidents. - Strategic thinking with operational excellence. - Engineering mindset with product-oriented thinking. - Strong documentation and governance discipline. Work Model : - Mandatory 5-day work from office (Bangalore or Mumbai). - On-call availability during major incidents or IR situations. Skills : - Security Incident Response. - Communication Skills. - Collaboration. - Cybersecurity Strategy. - Certifications Management. - Threat Analysis. - Continuous Learning. - Leadership Team Management. - Policy Development.