Head - SOC Incident Response

Adani Enterprises Limited

Required skills

Website: adanienterprises.com
Job details:
Responsibilities

Leadership and Strategy Development:

Lead enterprise-wide cybersecurity incident response strategy, ensuring alignment with business objectives and organizational risk appetite.
Act as the primary incident commander for high-severity (P1/P0) cybersecurity incidents, driving decisive action under pressure.
Define and mature the organization’s incident response operating model, playbooks, escalation paths, and KPIs.
Provide strategic guidance to SOC and security teams to improve detection fidelity, response efficiency, and resilience.
Present incident posture, trends, and security maturity insights to senior leadership and executive stakeholders.

Risk Management

Assess and prioritize cybersecurity incidents based on business impact, threat severity, and operational risk.
Ensure root cause analysis (RCA) is conducted post-incident to identify control gaps and systemic risks.
Translate incident learnings into corrective and preventive actions, reducing recurrence risks.
Support enterprise risk assessments by contributing incident data, threat trends, and exposure insights.
Coordinate with business units to manage residual risk and track remediation to closure.

Secure Software Development Lifecycle (SDLC)

Collaborate with application and product teams to integrate incident learnings into secure SDLC practices.
Provide guidance on incident-driven improvements to secure coding, dependency management, and environment hardening.
Engage with development teams during security incidents involving applications, APIs, or CI/CD pipelines.
Support post-incident reviews to strengthen preventive controls across design, development, and deployment stages.

Application Security Testing And Tools

Support application-level investigations, including log analysis, attack-path validation, and exploitation assessment.
Leverage application security testing outputs (SAST, DAST, SCA) to correlate findings with real-world incidents.
Work with AppSec teams to validate exploitability of vulnerabilities identified during incidents.
Ensure application-level remediation actions are verified and tracked to closure.

Compliance And Governance

Ensure incident response processes align with industry standards and regulatory requirements (NIST, ISO 27001, company policies).
Maintain and update incident response SOPs, playbooks, and governance documentation.
Support audits and compliance reviews by providing incident evidence, metrics, and response effectiveness reports.
Track business unit adherence to incident remediation SLAs and governance requirements.

Incident Response And Threat Intelligence

Lead end-to-end incident response activities: detection, triage, containment, eradication, and recovery.
Work closely with SOC analysts in a 24x7 environment to validate alerts and escalate high-risk threats.
Perform hands-on investigations using SIEM, EDR, and forensic tools across endpoints, networks, and cloud environments.
Conduct malware analysis, log correlation, and threat hunting to identify advanced or persistent threats.
Integrate threat intelligence (IOCs, TTPs, MITRE ATT&CK mapping) into proactive detection and response improvements.

Training And Awareness

Mentor SOC analysts and junior incident responders on investigation techniques and response best practices.
Conduct incident response simulations, tabletop exercises, and post-incident knowledge-sharing sessions.
Drive continuous skill development across security operations teams.
Promote a strong incident response culture with accountability and learning focus.

Collaboration With Other Security Teams

Partner with SOC, Vulnerability Assessment, Network, Cloud, Application, and Infrastructure teams during incidents.
Coordinate endpoint-level remediation with IT and infrastructure teams to ensure timely closure.
Act as a central bridge between security operations and business units during crisis situations.
Foster cross-team collaboration while enforcing response and remediation accountability.

Tool Selection And Automation

Lead or influence selection and optimization of SIEM, EDR, SOAR, and forensic tools.
Identify opportunities to automate alert triage, incident enrichment, and response workflows.
Continuously improve tooling coverage and effectiveness based on incident feedback and threat evolution.
Ensure tools are tuned to reduce false positives while maintaining high detection accuracy.

Vendor And Third-Party Risk Management

Coordinate incident response activities involving third-party vendors or service providers.
Assess security incidents impacting vendors and evaluate downstream business risk.
Support remediation tracking and compliance verification for third-party incident-related actions.
Work with procurement and governance teams to incorporate incident response expectations into vendor engagements.

Non‑Negotiable & Role-Critical Requirements

15–20 years of cybersecurity experience, with 5+ years in hands-on incident response and SOC operations.
Proven leadership during high-severity, business-impacting security incidents.
Strong, practical expertise in SIEM, EDR, malware analysis, and threat hunting.
Deep understanding of network security, TCP/IP, cloud security, and modern attack techniques.
Certifications such as GCIH, GCFA, or equivalent are mandatory.

On-site availability in Ahmedabad (no remote/hybrid flexibility).

Key Stakeholders - Internal

Key Stakeholders - External

Qualifications

Educational Background & Professional Qualifications:

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a closely related technical discipline.
Advanced degree such as a Master’s or MBA in Cybersecurity, Information Assurance, Information Security, or Risk Management is preferred.
Industry-recognized incident handling and response certifications such as GCIH, GCFA, GCIA, CEH, or CISSP.
Additional SOC, Threat Hunting, and platform-specific certifications (SIEM, EDR, SOAR tools) are considered a strong advantage.
Demonstrated proficiency in SIEM platforms, EDR solutions, and forensic analysis tools.
Hands-on experience with malware analysis, log analysis, threat hunting, and incident investigations.
Strong foundation in TCP/IP networking, network security architecture, and cloud security principles.

Working knowledge of leading security frameworks and methodologies, including NIST, MITRE ATT&CK, and ISO 27001. Click on Apply to know more.

This page is fully interactive when JavaScript is enabled. Please enable JavaScript to apply or browse related roles.