Security Operations Manager

1. Security Incident Response & Investigation Lead the investigation and remediation of escalated security incidents. Perform deep forensic analysis on compromised hosts, network traffic, and logs.

Conduct root cause analysis (RCA) and recommend long-term security improvements. Guide L1 and L2 analysts in incident handling and provide technical expertise. Ensure effective containment, eradication, and recovery strategies for incidents. 2.

Threat Hunting & Threat Intelligence Proactively hunt for threats using SIEM, EDR, and network monitoring tools. Analyze logs, network flows, and endpoint behaviors to detect advanced threats. Integrate Threat Intelligence (TI) feeds into detection and response workflows.

Research and track APT (Advanced Persistent Threat) groups and emerging attack tactics. 3. Security Engineering & SIEM Tuning Develop and fine-tune security rules, correlation logic, and alerts in SIEM (e.g., Splunk, QRadar, Sentinel). Improve automation workflows using SOAR (Security Orchestration, Automation, and Response).

Optimize IDS/IPS, firewalls, and endpoint security configurations to enhance protection. Identify false positives and adjust detection mechanisms accordingly. 4. Digital Forensics & Malware Analysis Conduct forensic analysis on compromised systems, including memory and disk analysis.

Reverse-engineer malware to understand its behavior and identify Indicators of Compromise (IoCs). Preserve and analyze digital evidence for legal or compliance investigations. Develop playbooks and procedures for handling various attack scenarios. 5.

Incident Handling & Playbook Development Create and refine incident response playbooks and workflows. Ensure alignment with industry best practices (NIST, MITRE ATT&CK, Cyber Kill Chain). Collaborate with Red Team to validate detections and improve SOC maturity.

Provide hands-on training and mentorship to junior SOC analysts. 6. Compliance & Reporting Ensure compliance with industry standards (ISO 27001, NIST, PCI-DSS, GDPR). Generate security reports and brief executive leadership on threats and incidents.

Support security audits, risk assessments, and compliance initiatives. Key Responsibilities 1. Security Incident Response & Investigation Lead the investigation and remediation of escalated security incidents.

Perform deep forensic analysis on compromised hosts, network traffic, and logs. Conduct root cause analysis (RCA) and recommend long-term security improvements. Guide L1 and L2 analysts in incident handling and provide technical expertise.

Ensure effective containment, eradication, and recovery strategies for incidents. 2. Threat Hunting & Threat Intelligence Proactively hunt for threats using SIEM, EDR, and network monitoring tools. Analyze logs, network flows, and endpoint behaviors to detect advanced threats.

Integrate Threat Intelligence (TI) feeds into detection and response workflows. Research and track APT (Advanced Persistent Threat) groups and emerging attack tactics. 3. Security Engineering & SIEM Tuning Develop and fine-tune security rules, correlation logic, and alerts in SIEM (e.g., Splunk, QRadar, Sentinel).

Improve automation workflows using SOAR (Security Orchestration, Automation, and Response). Optimize IDS/IPS, firewalls, and endpoint security configurations to enhance protection. Identify false positives and adjust detection mechanisms accordingly. 4.

Digital Forensics & Malware Analysis Conduct forensic analysis on compromised systems, including memory and disk analysis. Reverse-engineer malware to understand its behavior and identify Indicators of Compromise (IoCs). Preserve and analyze digital evidence for legal or compliance investigations.

Develop playbooks and procedures for handling various attack scenarios. 5. Incident Handling & Playbook Development Create and refine incident response playbooks and workflows. Ensure alignment with industry best practices (NIST, MITRE ATT&CK, Cyber Kill Chain).

Collaborate with Red Team to validate detections and improve SOC maturity. Provide hands-on training and mentorship to junior SOC analysts. 6. Compliance & Reporting Ensure compliance with industry standards (ISO 27001, NIST, PCI-DSS, GDPR).

Generate security reports and brief executive leadership on threats and incidents. Support security audits, risk assessments, and compliance initiatives. Required Skills & Qualifications: 1.

Technical Skills: Strong expertise in SIEM platforms (Splunk, QRadar, Microsoft Sentinel, ArcSight). Experience with Endpoint Detection & Response (EDR) solutions (CrowdStrike, Carbon Black, Defender ATP). Proficiency in Threat Intelligence Platforms (TIPs) and MITRE ATT&CK framework .

Hands-on experience with IDS/IPS, Firewalls, Proxy, WAF, and Network Security Monitoring (NSM) tools. Knowledge of digital forensics & malware analysis using tools like Volatility, Autopsy, or IDA Pro. Strong understanding of cloud security (Azure, AWS, GCP) and container security (Kubernetes, Docker).

Experience in security automation using Python, PowerShell, or Bash scripting . 2. Soft Skills: Strong analytical and problem-solving skills. Excellent communication and documentation skills.

Ability to work independently and handle high-pressure incidents. Leadership and mentoring skills to support SOC team growth. GIAC Certified Forensic Analyst (GCFA) or GIAC Reverse Engineering Malware (GREM) Microsoft SC-200 (Security Operations Analyst Associate) Qualification & Certification Any Graduate (IT, Computers, ENTC, Electronics).

Certifications ( Preferred but not Mandatory ): Certified Incident Handler (GCIH) – GIAC Certified Information Systems Security Professional (CISSP) Certified Ethical Hacker (CEH) EXPERIENCE  5 years of experience in a SOC, cybersecurity, or threat intelligence role.  Strong background in incident handling, forensics, and SIEM management .  Experience with attack simulation, penetration testing, or red team exercises is a plus.