Lead - Security Operations Center/IR & Threat Intelligence - BFSI

Actionable : 

- Complete oversight on all aspects of the Cyber Security Operations Center (CSOC)

- Define, develop and maintain appropriate policy, procedures and process.

- Develop appropriate metrics to measure effectiveness of SOC alerts, tickets closure

- Review operational and tactical metrics

- Guide and mentor the team, ensure training & skill development of the team.

- Develop executive metrics summary on SOC alerts

- Contribute strategically to move each area to next level

- Periodically review security events/incidents and ensure that they are classified appropriately, prioritize and escalated within the defined timelines.

- Ensure all the security events/incidents are captured within the incidents register and ITGRC system

- Ensure all the required regulatory reporting are performed of all the security events/incidents

- Handling the threat Intelligence received from different TI sources.

- Process documentation for Incident Management work programs in the bank.

- Review all the data to be provided to statutory and regulatory authority

- Lead operations committee meeting on Incident Response to ensure all the operational challenges are resolved on a periodic basis.

- Escalate to senior management and CISO if issues are not getting resolved affect the IR domain

- Execute projects to take IR domain to the next level

- Track and monitor strategy to achieve operational excellence through automation

- Escalate critical incidents that require management attention in a timely manner and provide timely updates

- Oversee emerging cyber threats, proactive modeling, threat validation

- Prepare threat awareness communications

- Developing and maintaining new technical and non-technical sources of information, threat research, threat profile development, analysis, briefings, and warnings

- Plan, track and monitor threat intelligence research to identify new threats

- Process documentation for Threat Intelligence work programs in the bank.

- Develop threat intelligence tactics, techniques and procedures

- Converting threat intelligence and research data into actionable intelligence

- Perform technical research into advanced, targeted attacks, crimeware campaigns, malware and other emerging technologies and techniques to identify and report on cyber attacks

- Assess threat risk and develop a contextual threat blueprint on the likelihood and impact to company networks and infrastructure based on the guidance provided by the Lead

- Perform proactive research on threats which are targeting organization, relevant industry and in some cases country specific

- Execute strategy to monitor the threat vectors across the black market / dark web which are involved into harmful activities against the organization

- Creating threat intelligence reports for senior management. These threat reports will help them understand the changing threat landscape

- Manage strategic initiative projects for Cyber Security

- Ensure appropriate budgets are maintained for the new cyber security projects

- Prepare funding approval documentation for new projects

- Engage with third party industry experts to conduct maturity reviews

- Be a single point of contact for IA and regulatory/compliance data requirements and evidences

- Ensure audit reports for the respective area managed are responded to in a timely manner

- Maintain appropriate evidence records

- Ensure no major non-conformance in the area managed.

- Maintain all SOC event, Incident in the appropriate format for regulatory submissions

- Maintain Cyber Security incident register

- Report critical cyber incidents to regulators in a timely manner

- Periodically conduct RBI Cyber Security circular gap assessment and review

- Involve in providing inputs with respect to Cyber Defense area for any regulatory Cyber Security circulars that may come

- Manage all the documentation for the area managed

- Review and update the design of the Cybersecurity Policy, Procedure, Process time to time to close gaps.

- Manage, maintain and enhance Cyber Resilience framework documentation.

- Involve in providing appropriate inputs to cover various scenarios during insurance renewal and procurement.