Assistant Vice President - Security Operations & Incident Response

Job Description :

Leadership & Collaboration :

- Lead and mentor SOC analysts and contractors, fostering a high-performance, growth-oriented culture.

- Build strong working relationships across Cybersecurity, Technology, and Business teams to support global operations.

- Act as an escalation point during major incidents, providing clear direction and timely communication.

- Provide technical leadership during complex investigations, guiding analysts through attacker-driven scenarios.

Security Operations & Incident Response :

- Oversee monitoring, triage, investigation, and response to security events across a global environment.

- Direct end-to-end incident response activities and ensure high quality documentation and reporting.

- Conduct proactive threat hunting to identify emerging risks and detection gaps.

- Perform deep dive analysis using endpoint telemetry, network forensics, and memory artifacts when required.

- Apply offensive security thinking to anticipate attacker behavior and strengthen detection engineering.

Operational Maturity & Process Improvement :

- Maintain and enhance SOC use cases, detection logic, runbooks, and playbooks.

- Continuously tune alerts to improve fidelity and reduce noise.

- Ensure detection logic is mapped to MITRE ATT&CK and reflects current adversary TTPs.

- Lead incident simulations and postmortems, driving measurable improvements in SOC performance.

- Develop metrics and dashboards to communicate risk posture and operational effectiveness.

- Develop and manage shift schedules to ensure consistent 24/7 operational coverage.

Automation, Tooling & Advanced Capabilities :

- Partner with Security Platform Engineering and drive SOAR automation to streamline workflows and enable analysts to focus on advanced investigations.

- Partner with Security Engineering to optimize tools, improve detection coverage, and enhance response capabilities.

- Collaborate with Threat Intelligence and Assessment teams to strengthen monitoring and accelerate autonomous response.

Governance, Reporting & Threat Awareness :

- Prepare concise, actionable reports for leadership on incidents, trends, and recommended improvements.

- Stay current with global threat developments and translate insights into operational enhancements.

- Ensure alignment with internal policies and financial-sector regulatory expectations.

Qualifications :

Education :

- Bachelor's degree in computer science, Information Technology, Cybersecurity, or a related field; equivalent professional experience considered.

- Industry-recognized certifications such as GSEC, GCIA, CISSP, OSCP, CEH, or similar are advantageous.

- Offensive security certifications such as OSEP, OSWE, GXPN, or CREST are highly desirable.

- Advanced training in incident response, threat hunting, or digital forensics is a plus.

- Training in malware analysis, exploit development fundamentals, or adversary simulation is a strong advantage.

Experience Required :

- 10+ years of experience in enterprise cybersecurity or within a reputable security consulting/managed services organization.

- 7+ years of hands-on experience in a Security Operations Center (SOC) supporting large-scale, complex environments.

- Proven experience leading and developing technical teams, including performance management and mentoring.

- Demonstrated success managing 24x7 operational environments and shift-based teams.

- Strong background in incident response, including chain of custody processes, forensic tools, and structured investigation methodologies.

- Practical experience with SOAR platforms and automation workflows; ability to drive efficiency through orchestration.

- Experience with threat hunting methodologies, behavioral analytics, and detection engineering is preferred.

- Prior exposure to financial services, regulatory expectations, or high security environments is highly desirable.

General Requirements :

- Exceptional communication skills with the ability to influence stakeholders and translate technical issues into business risk.

- Strong understanding of both offensive and defensive security principles, including attacker TTPs and modern detection strategies.

- Comfortable diving deep into technical investigations and challenging teams with an attacker-focused perspective.

- Strong curiosity and passion for understanding how attackers operate and using that knowledge to strengthen defenses.

- Demonstrated ability to drive measurable improvements in monitoring, detection, and response at scale.

- Collaborative mindset-works effectively across global teams and incorporates diverse perspectives to solve complex problems.

- Highly analytical with strong decision-making skills, especially under pressure or during high-severity incidents.

- Calm, organized, and resilient when working with tight deadlines or rapidly evolving situations.

- Proven track record of building trust, leading by example, and maintaining high ethical standards.

- Ability to work the 14:00 - 23:00 IST shift, with flexibility to adjust based on business needs.

(ref:hirist.tech)