T&T | Cyber | D&R | Director - Incident Response & Handling

Vista previa de la oferta

T&T | Cyber | D&R | Director - Incident Response & Handling

senior · Operations

T&T | Cyber | D&R | Director - Incident Response & Handling
• Job requisition ID : 110394 
• Location: Bengaluru
• Entity: Deloitte Touche Tohmatsu India LLP 

The team

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks: Learn more about Cyber | Deloitte

Your work profile 

• Lead enterprise-wide SIEM transformation and migration programs from legacy platforms such as Splunk, QRadar, ArcSight,  LogRhythm,  Securonix, Exabeam, and Elastic to Next Generation SIEM platforms like Google SecOps, Microsoft Sentinel, Palo Alto Cortex, etc.
• Define migration strategies, operating models, implementation roadmaps, and transition plans.
• Oversee assessment, sizing, onboarding, normalization, enrichment, and optimization of security telemetry.
• Google Security Operations (Google SecOps)
• Microsoft Sentinel , Palo Alto Cortex XSIAM/XDR
• Establish governance frameworks, delivery milestones, risk management plans, and quality controls during implementation programs.
• Manage multiple concurrent transformation engagements while ensuring adherence to timelines, budgets, and quality standards.
• Manage and support a team of SOC analysts (Tier 1, Tier 2, Tier 3), incident responders, and engineers in handling security incidents for clients
• Lead security operations and managed detection & response (MDR) services for enterprise and MSSP environments.
• Establish and operationalize Next Generation SOC capabilities using cloud-native security platforms.
• Ensure effective monitoring, triage, investigation, response, and remediation processes across client environments.
• Define and manage operational KPIs, SLAs, and security performance metrics.
• Drive continuous improvement initiatives focused on detection quality, analyst productivity, and response effectiveness.
• Support transition from project implementation to business-as-usual operations.     

• Lead development and optimization of advanced detection content and threat detection use cases.
• Design and implement:
• Detection rules
• Correlation logic
• Behavioural analytics
• UEBA use cases

• Lead security orchestration and automation initiatives across SIEM and SOC ecosystems.
• Design and implement automated playbooks and workflows for incident response and operational activities.
• Integrate security platforms with:
• EDR/XDR solutions
• Identity platforms
• Cloud platforms
• Ticketing systems
• Vulnerability management tools
• Improve Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) through automation.

Key Skills Required: 

• Education: Bachelor’s degree in information security, Computer Science, or a related field. A master’s degree in Cybersecurity or Business Management is preferred            
• 13+ years of experience in cybersecurity, with at least 5+ years in SOC management or an equivalent leadership role
• Experience working in an MSSP or managing security operations for multiple clients is preferred
• Strong experience with security tools (SIEM, EDR, IDS/IPS), threat intelligence, and incident response
• Proven track record of leading teams in a 24/7 SOC environment

• Google Professional Security Operations Engineer
• Palo Alto Networks Certified XSIAM Analyst or Engineer
• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• GIAC (GCIH, GCIA, GSOC)
• CompTIA Security+ 

• Google Security Operations (Google SecOps)
• Microsoft Sentinel
• Palo Alto Cortex XSIAM / Cortex XDR
• SIEM migration and modernization programs
• SOC transformation and operating model design
• Detection engineering and threat hunting
• Security automation and SOAR
• MITRE ATT&CK Framework
• Incident Response and Security Operations