Deputy Unit Manager - Information Security

Information security team member who is proficient in handling of Incident response maintain Incident response governance in SOC lifecycle.

• Role: The SOC L1 Engineer is responsible for Security Operations and Incident Management, performing continuous monitoring and alert handling activities across the SOC lifecycle. The role ensures that security alerts and events are analyzed, triaged, investigated, categorized, escalated, and closed in a consistent, auditable, and risk-aligned manner, in accordance with established SOC processes, policies, SLAs, and regulatory requirements.
• The SOC L1 Engineer serves as the first line of defense for security monitoring, validating alerts from multiple security platforms, identifying potential security incidents, and escalating confirmed threats to higher support tiers for further investigation and response. The role is responsible for maintaining accurate incident records, documenting findings, and ensuring timely communication and coordination throughout the incident management lifecycle.
• As the SOC operates on a 24x7 basis, this position requires availability to work in rotational shifts to provide continuous monitoring, rapid response, and uninterrupted security coverage for the organization's technology environment.

• Govern adherence to defined alert handling SLAs (acknowledgement, triage, escalation, and containment).
• Ensure mandatory escalation paths are followed for high and critical alerts.
• Monitor SLA breaches, identify root causes, and drive corrective and preventive actions.

• Define and enforce criteria for converting alerts into incidents.
• Ensure correlated alerts are grouped into single incidents to reflect true attack scenarios.
• Validate incident severity, scope, and impact prior to escalation to Incident Response teams.

• Define and monitor SOC alert handling KPIs, including MTTA / MTTR, false positive rate, alert backlog, incident conversion ratio.
• Conduct regular alert quality reviews and highlight areas for process improvement.
• Translate lessons learned from alerts and incidents into process, playbook, and detection enhancements.

• Own and continuously improve Incident Response Governance, including policies, playbooks, runbooks, and escalation matrices.
• Design and update incident response playbooks for cloud, identity, endpoint, email, data, and thirdparty incidents.
• Drive SOC maturity improvements by identifying process gaps and optimizing response workflows.
• Risk analysis and mitigation
• Vendor Co-ordination
• Strong troubleshooting, analytical, and communication skills
• Energetic, self-motivated and self-sufficient in accomplishing tasks.
• Good analytical and problem solving skills.

• Identification of right contacts to channelise the issue/problem for closure.
• Review the alert/incident and categorised True positive / False positive and take required steps.
• Discuss observation response as applicable to improve security controls.
• Decide if the policy and procedure documents need changes based on new regulations or audit outcomes; potential regulatory actions due to non-compliances.

• Handling of fast changing environment with variety of cloud service providers.
• Handling of compliance expectations in stringent timelines.
• Handling multiple stakeholders at a time.
• Coordination with third party consultants who assist in auditing and compliance initiatives.

a) Qualifications

Minimum 3+ years of experience in handling team (lead) in Security operations center.

• Strong hands-on experience on Microsoft Sentinel incident handling including Azure IAM, Key vault, WAF, EDR, CSPM CWP.
• Strong knowledge experience on alert correlation aspect.
• Sensible on organization risk, IT risk impact analysis.
• Experience in Project management.
• Positive attitude, Hard Worker and team player
• Certifications like CEH (Ethical Hacking), Azure/AWS Security, ISO 27001 is mandatory