Incident Manager

The Security Operations & Incident Response professional will be responsible for orchestrating enterprise-wide incident response strategies across both OT and IT environments. The role demands deep operational expertise, the ability to coordinate with threat intelligence, forensics, red / blue teams, and the vision to continuously evolve detection and response capabilities in line with emerging threats. The role demands leadership in defending critical infrastructure, industrial networks, and enterprise systems.Qualifications & Certifications : Bachelor’s or Master’s in Cybersecurity, Computer Science, or EngineeringPreferred certifications : CISSP, CISM, GCIA, GCIH, or SOC-related credentials12 + years of cybersecurity experience, with at least 6 years in SOC / IR leadership rolesExperience managing global SOC operations or OT-specific cyber operations is a strong plusKey Responsibilities : Oversee real-time incident handling, escalation management, and response coordination for cyber threats, breaches, and anomaliesAct as the primary escalation point during high-severity incidents, ensuring containment and rapid resolutionDesign and maintain incident response runbooks, playbooks, SLA matrices, and crisis communication protocolsLead and manage triage activitiesEnsure tight integration between SOC operations, threat intelligence, DFIR, and red / blue teamsDrive detection engineering efforts to improve alert quality, correlation logic, and MITRE ATT&CK mappingImplement continuous improvement programs in MTTR, false positive reduction, and analyst productivityLead post-incident RCA reviews, reporting, and feedback loops to enhance readinessManage relationships with OEMs, MSSPs, and security product vendors for technology alignmentMentor SOC managers, team leads, and analysts to build a resilient and responsive operations teamEnsure compliance with security and privacy standards (e.g., NIST, IEC 62443, ISO 27001, DPDP Act)Key Skills & Technologies : Deep expertise in SIEM (e.g., Splunk, QRadar, LogRhythm, SentinelOne), SOAR platforms, EDR / XDR tools, threat intelligence platformsStrong knowledge of network security, log analysis, endpoint telemetry, and OT-specific telemetry correlationFamiliarity with MITRE ATT&CK, cyber kill chain, and threat hunting techniquesKnowledge of OT security architectures including SCADA, PLCs, DCS, and OT network segmentationScripting and automation exposure (Python, PowerShell, Bash) preferredFamiliarity with OT SOC environments, ICS protocol detection (Modbus, DNP3), and industrial anomaly detection tools (e.g., Nozomi, Claroty)Leadership & Personality Traits : Strategic thinker with an operations-first mindset and execution rigorCalm, decisive, and clear-headed in crisis and high-pressure scenariosStrong stakeholder engagement and communication skills across technical and executive levelsProven ability to lead multi-location teams with cultural sensitivity and high performanceContinuous learner with a growth mindset and passion for cybersecurity excellencePreferred Industry Background : Large industrial conglomerates (Power, Ports, Renewables, Mining, Airports)OT and IT OEMsMSSPs, SOC service providersConsulting firms with cyber defence practices (e.g., Big 4)please email your resume at