Security Delivery Lead

Security Delivery Lead

Integrated delivery owner for 24x7 L1 and L2 security operations across all SecOps towers.

Role level

Delivery Lead

Domain

Security Operations (SecOps)

Scope

NetSec, IDAM, Malware Tools, DLP & SecOps Command Center (L1)

Own delivery of the client's security operations end to end. Manage SLAs, escalations, MIM, invoicing, resourcing and contractual reviews across NetSec, IDAM, Malware Tools, DLP and the SecOps Command Center.

Process

Service Delivery Ownership

• Own end-to-end delivery of L1 and L2 security operations.
• Lead the SecOps Command Center (L1) and the NetSec, IDAM, Malware Tools and DLP pods.
• Act as single point of contact for the client security leadership.
• Run daily stand-ups and weekly service reviews with tower leads.
• Drive service improvement plans to closure.

SLA, Reporting and Governance

• Track response and resolution SLAs across all security towers.
• Publish weekly and monthly SLA, KPI and backlog reports.
• Present service performance at monthly and quarterly governance reviews.
• Maintain the RAID log for security services.
• Enforce ServiceNow ticket hygiene and closure quality.

Incident, Escalation and MIM

• Attend MIM bridge calls for P1/P2 and security incidents.
• Own client and internal escalations through to closure.
• Inform the client promptly of security issues, with remediation options.
• Drive RCA and problem management with corrective action plans.
• Coordinate with Infra towers, OEM vendors and client L3 teams.

Commercials and Contract

• Own monthly invoicing inputs and reconciliation for security services.
• Track deliverables against SOW scope and contractual obligations.
• Raise and manage change requests for scope changes.
• Lead contractual reviews, including service credits and penalties.

Resourcing and People

• Plan capacity, shift rosters and 24x7 on-call coverage.
• Hire, onboard and retain engineers; manage backfills and leave cover.
• Maintain the skill matrix and cross-skilling plan across pods.
• Run performance reviews, coaching and career plans for the team.

Security Compliance and Risk

• Ensure adherence to client security policies and standards.
• Track firewall, endpoint agent, patch and DLP policy compliance.
• Support internal and external audits with evidence.
• Oversee access reviews and privileged access governance.

Continual Improvement

• Drive automation, alert tuning and repeat-incident reduction.
• Keep SOPs, runbooks and knowledge-base articles current.
• Lead onboarding and transition of new security services.

Tools Familiarity

• Zscaler (ZIA / ZPA)
• Palo Alto Firewalls (Panorama)
• Microsoft Purview
• Email Encryption
• Symantec DLP and AIP
• Netskope
• Microsoft Defender for Endpoint
• CrowdStrike Falcon
• Entra ID (Azure AD) and Active Directory
• Okta
• CyberArk
• ServiceNow (ITSM, reporting and dashboards)
• Datadog & PagerDuty
• Splunk
• PPT / Excel for service reporting (good to have)
• Jira and Confluence (good to have)

Technologies Knowhow

• Network security: NGFW, secure web gateway, zero trust access
• Identity and access: SSO, MFA, PAM, joiner-mover-leaver
• Endpoint security: EDR, anti-virus, phishing response
• Data protection: DLP, data classification, encryption
• Email security and encryption
• ITIL service management: incident, problem, change, request
• Security frameworks: ISO 27001, NIST CSF
• Cloud security basics: Azure and AWS (good to have)
• SIEM and SOC operations (good to have)

Experience

• 12+ years in IT and security operations
• 10+ years as Security Delivery lead in an infra managed services setup
• Led 24x7 multi-tower security operations for a global enterprise
• Managed onshore and offshore teams of 20+ engineers
• Basic knowledge of Zscaler, Palo Alto, MS Purview, email encryption, Defender for Endpoint, CrowdStrike, Entra ID, CyberArk and Workday
• SLA management, invoicing and contract reviews in an MSP model
• MIM participation and senior stakeholder escalation handling
• Clear written and spoken English; confident with senior leadership

Certifications Preferred

• CISSP or CISM
• ITIL 4 Foundation
• Microsoft SC-100 / SC-200, Zscaler or Palo Alto certification (good to have)
• Preferred, not mandatory