T&T | Cyber: D&R I Manager | Incident Response & Handling | Pan India

Vista previa de la oferta

T&T | Cyber: D&R I Manager | Incident Response & Handling | Pan India

manager · Other

The team  

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity  

Your work profile 

This role is accountable for the effectiveness, consistency, and continuous improvement of the Incident Management process, ensuring incidents are managed predictably, transparently, and in a way that reduces recurrence and operational risk. 

The Incident Coordinator provides process leadership for the coordination and communication of all service-impacting outages, ensuring timely resolution and minimal impact to customers and downstream users. Working in partnership with technical teams and business stakeholders across the organisation, the role structures and facilitates incident investigation and resolution activities while maintaining end-to-end ownership of the incident lifecycle. 

The role is focused on incident identification, logging and clustering, coordination of resolution efforts, stakeholder communication, post-incident tracking, and formal closure. Following incident resolution, the role leads incident retrospectives and post-mortem activities to ensure lessons learned are documented, actions are clearly owned, and systemic issues are progressed into problem management and continuous improvement initiatives. 

Following Incident Management process, this role plays a key role in the Problem Management process by ensuring that recurring, high-impact, or systemic incidents are identified, analysed, and progressed beyond incident resolution. The role facilitates and chairs problem review forums as required, ensuring root cause analysis is completed to an agreed standard, corrective and preventive actions are defined, and progress is tracked through to resolution. 

Additionally, the role is responsible for proactively identifying trends, patterns, and underlying issues from incident data, post-incident reviews, and operational metrics, and ensuring these are formally transitioned into Problem Management with clear ownership and prioritisation. 

Incident Responder: 

• Ensure all major incidents are accurately logged in the relevant toolset, with complete and high-quality data captured (impact, urgency, affected services, timeline, resolution details, etc.) 
• Lead and facilitate major incident bridge calls, coordinating investigation and resolution activities with Service/Application Owners and resolving teams 
• Provide clear, timely, and audience-appropriate communications throughout the incident lifecycle, tailored for business users, technology stakeholders, senior management,  
• Maintain oversight of incident progress to ensure timely resolution and adherence to agreed SLAs and operational standards 
• Manage the production and publication of Post-Incident Reports (PIRs), ensuring consistency, completeness, and timely delivery 
• Lead post-incident retrospectives, ensuring: 
• Process adherence is reviewed 
• Lessons learned are documented 
• Corrective actions are clearly defined, owned, and tracked 
• Ensure post-incident recovery steps and findings are documented to support process improvements and knowledge base creation 
• Chair weekly global incident review meetings, focusing on key incidents, resolution quality, and follow-up actions 
• Lead monthly incident reviews with Compliance and Operational Risk Management teams 

Problem Management: 

• Proactively identify recurring, high-impact, or systemic issues observed during incident management and formally transition them into Problem Management 
• Ensure problems are accurately logged with sufficient data to support effective Root Cause Analysis (RCA) 
• Govern the Problem Management lifecycle, ensuring problems progress through: Identification, assessment and prioritisation, Root Cause Analysis, Resolution and closure 
• Ensure all action items are recorded and managed as relevant problem tasks 
• Chair Problem Management review forums, ensuring: Clear ownership and accountability, Blockers are escalated and resolved, Status and risk are communicated effectively to management 

Reporting: 

• Develop and maintain incident and problem performance dashboards and reports, including: 
• Produce and distribute monthly service level, operational and management reporting, tailored to the needs of different audiences (operations, senior leadership, risk/compliance) 
• Provide ongoing visibility into ticket queue health, backlog trends, and MTTR performance 

Continual Improvement: 

• Drive continuous improvement of Incident and Problem Management processes and tooling in collaboration with ITSM, operations, and engineering/development teams 
• Perform quality assurance reviews on incident records and post-incident outputs to ensure consistency, accuracy, and process compliance 
• Work with teams to ensure process SLAs and operational standards are consistently met during incidents 
• Partner with the ITSM team to embed best practices, standardisation, and operational maturity across the organisation 

Future potential role expansion: 

• Increase scope with additional IT Service Management process control activities: 
• Change Management 
• Knowledge Management  

Key Skills Required:

• Experience - 8-15 years
• Demonstrated experience in Incident Management and/or Major Incident coordination, with a proven ability to manage high-severity incidents in complex, production environments 
• Strong organisational and multitasking capabilities, with the ability to remain calm, decisive, and responsive under pressure, particularly during major service outages 
• Highly effective written and verbal communication skills, with experience producing clear incident communications, post-incident reports, and management-level summaries 
• Ability to adapt communication style effectively for both technical and non-technical audiences, including senior management and business stakeholders 
• Excellent problem-solving and analytical skills, with the ability to assess incomplete information, make sound decisions, and prioritise actions in time-critical situations 
• Strong collaboration and stakeholder management skills, enabling effective partnership across a wide range of teams, functions, and seniority levels 
• Ability to apply knowledge gained through experience, education, and training to resolve issues, remove operational barriers, and drive continuous improvement 
• Solid understanding of the governance, risk, and compliance requirements relevant to the role, including the ability to operate within defined policies, controls, and regulatory frameworks.
• Digital forensics (Windows, Mac OS, Linux/Unix) 
• Thorough understanding of Cyber kill chain and MITRE ATT&CK framework. 
• Experience with one or more of SIEM tools such as QRadar, Sentinel, etc... is required 
• Experience on EDR tools for Incident response and threat hunting (Crowdstrike, MS Defender, Sentinel One) 
• Strong knowledge and experience with commonly used forensic toolsets, including EnCase, FTK. 
• Experience reviewing raw logs and performing advanced data correlation and analysis (i.e., firewall, network flow, IPS, endpoint protection, web application, host OS, database, AAA, etc…) 
• Experience of network & host-based forensic analysis and techniques 
• Experience of malware analysis and understanding attack techniques. 
• Master's or Bachelor’s degree in Cybersecurity, Information Technology, or related field.