Security Monitoring & Incident Response
● Monitor and analyze security alerts and events from various sources to identify
and assess potential security incidents.
● Lead in-depth investigations of security incidents, determining root causes,
impacts, and appropriate response measures.
● Drive incident response activities to contain, eradicate, and recover from
high-severity security incidents.
● Collaborate closely with L1 and L2 SOC teams to prioritize and escalate
incidents as needed.
● Provide comprehensive documentation of incidents, including findings, actions
taken, and strategic recommendations.
● Manage and optimize security tools and technologies used within the SOC
environment.
● Collaborate with cross-functional teams (IT, network operations, system
administrators) to coordinate incident response.
● Communicate with internal and external stakeholders regarding incident status,
remediation actions, and lessons learned.
● Participate in the development and enhancement of SOC procedures, workflows,
and incident response plans.
● Stay updated on industry trends, emerging threats, and new security
technologies.
● Conduct proactive threat hunting.
● Perform security incident tabletop exercises and simulations.
● Troubleshoot log collection, indexing, parsing, and reporting.
● Guide L1 & L2 SOC teams.
Identity & Access Management (IAM) & Governance
● Establish and execute access governance programs and policies.
● Define and enforce access control policies (RBAC, ABAC, PBAC).
● Ensure adherence to least privilege and segregation of duties (SoD).
● Develop and execute an access certification program.
● Design, implement, and manage Identity Access & Governance (IAM) policies.
● Define and enforce Privileged Access Management (PAM) policies.
● Manage user onboarding, offboarding, and role changes in compliance with
security policies.
● Collaborate with IT, security, and compliance teams to align IAM with business
goals.
● Maintain documentation of IAM policies, processes, and configurations.
● Generate reports and metrics on IAM activities and security posture.
● Stay current with compliance standards (FedRAMP, SOX, GDPR, PCI, NIST).
● Provide operational support for IAM systems, including on-call rotation.
Application & Cloud Security
● Perform security assessments and penetration testing of web applications.
● Conduct threat modeling using STRIDE methodology.
● Implement vulnerability management best practices at scale.
● Assess AI/LLM technologies for security risks.
● Evaluate modern application architectures for security considerations.
● Utilize cloud platforms (AWS, GCP) with security best practices.
● Apply OWASP standards (Top 10, Testing Guide, SAMM framework).
● Use security testing tools (Burp Suite, SonarQube, OWASP ZAP, Nmap).
● Prioritize vulnerabilities based on risk analysis.
Compliance & Risk Management
● Ensure adherence to regulatory requirements (RBI IT, SOX, GDPR, PCI, NIST).
● Identify, assess, and mitigate IT and operational risks.
● Develop and maintain governance frameworks aligned with regulations.
● Draft and update IT and security policies.
● Facilitate internal and external audits.
● Assess third-party/vendor risks for compliance.
● Oversee incident response and root cause analysis for security incidents.
● Conduct compliance training and awareness sessions.
Security Operations & Maintenance
● Install, operate, and maintain security software.
● Resolve, report, and document security issues or breaches.
● Monitor and configure centralized log and alert management systems.
● Review logs, network traffic, and security data for anomalies.
● Optimize security systems through tuning and enhancements.
Documentation & Reporting
● Maintain comprehensive documentation of security policies, processes, and
configurations.
● Generate reports and metrics on security activities.
● Communicate technical concepts to both technical and non-technical audiences.
