Unit Manager - Information Security/Senior Unit Manager - Information Security

Job Purpose

Information security team member who is proficient in handling of Incident response & maintain Incident response governance in SOC lifecycle.

A- Minimum required Accountabilities for this role

Role: The SOC L1 Engineer is responsible for Security Operations and Incident Management, performing continuous monitoring and alert handling activities across the SOC lifecycle. The role ensures that security alerts and events are analyzed, triaged, investigated, categorized, escalated, and closed in a consistent, auditable, and risk-aligned manner, in accordance with established SOC processes, policies, SLAs, and regulatory requirements.

The SOC L1 Engineer serves as the first line of defense for security monitoring, validating alerts from multiple security platforms, identifying potential security incidents, and escalating confirmed threats to higher support tiers for further investigation and response. The role is responsible for maintaining accurate incident records, documenting findings, and ensuring timely communication and coordination throughout the incident management lifecycle.

As the SOC operates on a 24x7 basis, this position requires availability to work in rotational shifts to provide continuous monitoring, rapid response, and uninterrupted security coverage for the organization's technology environment.

a) Perform incident classification and severity assessment, validating true positives, false positives, and business impact. Work Experience on handling Azure, AWS, GCP & OCI incident in depth including IAM & key vaults alerts.

b) Coordinate with multiple members in SOC, threat intelligence, IT, cloud, identity, and endpoint teams during active incidents.

c)  Maintain accurate incident documentation, including evidence collection, timelines, actions taken, and final resolution.

d) Ensure incidents are handled within defined SLAs, SLOs, and regulatory timelines.

e) Conduct or support post incident reviews / lessons learned sessions and ensure closure actions are tracked.

f) Support internal and external audits, compliance checks, and regulatory reporting related to incident response.

g) Ensure 24x7 SOC operational readiness for incident response activities.

SLA, Escalation & Response Governance

a) Govern adherence to defined alert handling SLAs (acknowledgement, triage, escalation, and containment).

b) Ensure mandatory escalation paths are followed for high and critical alerts.

c) Monitor SLA breaches, identify root causes, and drive corrective and preventive actions.

Alert-to-Incident Conversion Governance

a) Define and enforce criteria for converting alerts into incidents.

b) Ensure correlated alerts are grouped into single incidents to reflect true attack scenarios.

c) Validate incident severity, scope, and impact prior to escalation to Incident Response teams.

Metrics, Reporting & Continuous Improvement

a) Define and monitor SOC alert handling KPIs, including:

• MTTA / MTTR

• False positive rate

• Alert backlog

• Incident conversion ratio|b) Conduct regular alert quality reviews and highlight areas for process improvement.

c) Translate lessons learned from alerts and incidents into process, playbook, and detection enhancements.

B- Additional Accountabilities pertaining to the role

? Own and continuously improve Incident Response Governance, including policies, playbooks, runbooks, and escalation matrices.

? Design and update incident response playbooks for cloud, identity, endpoint, email, data, and third?party incidents.

? Drive SOC maturity improvements by identifying process gaps and optimizing response workflows.

? Risk analysis and mitigation

? Vendor Co-ordination

? Strong troubleshooting, analytical, and communication skills

? Energetic, self-motivated and self-sufficient in accomplishing tasks.

? Good analytical and problem solving skills.

Key Decisions / Dimensions

• Identification of right contacts to channelise the issue/problem for closure.

• Review the alert/incident and categorised True positive / False positive and take require steps.

• Discuss observation response as applicable & improve security controls.

• Decide if the policy and procedure documents need changes based on new regulations or audit outcomes.|Potential regulatory actions due to non-compliances

Major Challenges

• Handling of fast changing environment with variety of cloud service providers

• Handling of compliance expectations in stringent timelines

• Handling multiple stakeholders at a time

• Coordination with third party consultants who assist in auditing and compliance initiatives

Required Qualifications and Experience

a) Qualifications

Minimum 3+ years of experience in handling team (lead) in Security operations center

b) Work Experience

• Strong hands-on experience on Microsoft Sentinel incident handling including Azure IAM, Key vault, WAF, EDR, CSPM & CWP.

• Strong knowledge & experience on alert correlation aspect

• Sensible on organization risk, IT risk & impact analysis.

• Experience in Project management.

• Positive attitude, Hard Worker and team player

• Certifications like CEH (Ethical Hacking), Azure/AWS Security, ISO 27001 is mandatory