Soc Engineer

The SOC Engineer acts as the primary internal interface between the Managed Security Service Provider (MSSP) and organizational stakeholders for all cybersecurity incidents, alerts, and security events. The role is responsible for validating incidents received from the MSSP, coordinating investigation and remediation activities with internal technology and business teams, ensuring timely resolution of security incidents, tracking closure of observations, and supporting the organization's overall cybersecurity posture. The incumbent will work closely with Infrastructure, Network, Cloud, Application, Endpoint, and Business teams to ensure effective incident response, regulatory compliance, and continuous improvement of security operations.

Key Responsibilities Security Incident Management

• Act as the primary internal point of contact for all security incidents raised by the MSSP (SOC vendor).
• Review, assess, and prioritize security alerts and incidents received from the SOC vendor.
• Coordinate with internal stakeholders for investigation, containment, eradication, and recovery activities.
• Ensure timely closure of incidents within defined SLAs.
• Track incident lifecycle from detection to closure.
• Escalate critical incidents to Information Security leadership and management.
• Facilitate incident response bridge calls during Major Security Incidents.
• Ensure proper documentation of actions taken for every incident

Stakeholder Coordination

• Liaise with:
• IT Infrastructure Team
• Network Team
• Cloud Operations Team
• Application Support Team
• Database Administrators
• End-User Computing Team
• Business Application Owners
• Follow up on remediation actions and ensure closure within agreed timelines.
• Conduct periodic reviews with stakeholders on open incidents and corrective actions.
• Drive accountability for remediation of security findings.

Incident Tracking & Governance

• Maintain incident tracker and dashboard for all security incidents.
• Ensure Root Cause Analysis (RCA) and corrective actions are documented for significant incidents.
• Monitor compliance with incident response SLAs.
• Prepare weekly and monthly management reports.
• Track recurring incidents and identify trends.
• Recommend process improvements to reduce incident recurrence.

MSSP Vendor Management

• Coordinate daily operations with SOC service provider.
• Review MSSP performance against contractual SLAs and KPIs.
• Validate quality of alerts, investigations, and escalations raised by the MSSP.
• Participate in monthly service review meetings.
• Ensure continuous tuning and optimization of security monitoring use cases through the MSSP.
• Review SOC reports and security recommendations provided by the vendor.

Vulnerability & Threat Management

• Review vulnerability alerts and threat advisories received from MSSP and other sources.
• Coordinate remediation with system owners.
• Track closure of critical and high-risk vulnerabilities.
• Monitor patching compliance and exception management.

Required Skills Technical Knowledge

• Understanding of Security Operations Centre processes.
• Knowledge of Incident Response lifecycle.
• Understanding of SIEM, EDR/XDR, Firewalls, WAF, IDS/IPS, and Cloud Security.
• Knowledge of Windows, Linux, Active Directory, and Network Security concepts.
• Familiarity with MITRE ATT&CK framework.
• Understanding of vulnerability management and patch management.

Experience

• 1-3 years of experience in Cyber Security or Information Security.
• Experience working with SOC environments preferred.
• Experience in incident management, vulnerability management, or cyber operations.
• Prior exposure to BFSI/NBFC regulatory environments is desirable.