Deputy Unit Manager - Information Security

Location Name: Pune Corporate Office - Mantri
Job Purpose
Information security team member who is proficient in handling of Incident response & maintain Incident response governance in SOC lifecycle.
Duties And Responsibilities
A- Minimum required Accountabilities for this role
Role: The SOC L1 Engineer is responsible for Security Operations and Incident Management, performing continuous monitoring and alert handling activities across the SOC lifecycle. The role ensures that security alerts and events are analyzed, triaged, investigated, categorized, escalated, and closed in a consistent, auditable, and risk-aligned manner, in accordance with established SOC processes, policies, SLAs, and regulatory requirements.
The SOC L1 Engineer serves as the first line of defense for security monitoring, validating alerts from multiple security platforms, identifying potential security incidents, and escalating confirmed threats to higher support tiers for further investigation and response. The role is responsible for maintaining accurate incident records, documenting findings, and ensuring timely communication and coordination throughout the incident management lifecycle.
As the SOC operates on a 24x7 basis, this position requires availability to work in rotational shifts to provide continuous monitoring, rapid response, and uninterrupted security coverage for the organization's technology environment.
Key Responsibilities
Perform incident classification and severity assessment, validating true positives, false positives, and business impact. Work Experience on handling Azure, AWS, GCP & OCI incident in depth including IAM & key vaults alerts.
Coordinate with multiple members in SOC, threat intelligence, IT, cloud, identity, and endpoint teams during active incidents.
Maintain accurate incident documentation, including evidence collection, timelines, actions taken, and final resolution.
Ensure incidents are handled within defined SLAs, SLOs, and regulatory timelines.
Conduct or support post incident reviews / lessons learned sessions and ensure closure actions are tracked.
Support internal and external audits, compliance checks, and regulatory reporting related to incident response.
Ensure 24x7 SOC operational readiness for incident response activities.
SLA, Escalation & Response Governance
Govern adherence to defined alert handling SLAs (acknowledgement, triage, escalation, and containment).
Ensure mandatory escalation paths are followed for high and critical alerts.
Monitor SLA breaches, identify root causes, and drive corrective and preventive actions.
Alert-to-Incident Conversion Governance
Define and enforce criteria for converting alerts into incidents.
Ensure correlated alerts are grouped into single incidents to reflect true attack scenarios.
Validate incident severity, scope, and impact prior to escalation to Incident Response teams.
Metrics, Reporting & Continuous Improvement
Define and monitor SOC alert handling KPIs, including:
MTTA / MTTR
False positive rate
Alert backlog
Incident conversion ratio|b) Conduct regular alert quality reviews and highlight areas for process improvement.
Translate lessons learned from alerts and incidents into process, playbook, and detection enhancements.
B- Additional Accountabilities Pertaining To The Role
Own and continuously improve Incident Response Governance, including policies, playbooks, runbooks, and escalation matrices.
Design and update incident response playbooks for cloud, identity, endpoint, email, data, and third?party incidents.
Drive SOC maturity improvements by identifying process gaps and optimizing response workflows.
Risk analysis and mitigation
Vendor Co-ordination
Strong troubleshooting, analytical, and communication skills
Energetic, self-motivated and self-sufficient in accomplishing tasks.
Good analytical and problem solving skills.
Key Decisions / Dimensions
Identification of right contacts to channelise the issue/problem for closure.
Review the alert/incident and categorised True positive / False positive and take require steps.
Discuss observation response as applicable & improve security controls.
Decide if the policy and procedure documents need changes based on new regulations or audit outcomes.|Potential regulatory actions due to non-compliances
Major Challenges
Handling of fast changing environment with variety of cloud service providers
Handling of compliance expectations in stringent timelines
Handling multiple stakeholders at a time
Coordination with third party consultants who assist in auditing and compliance initiatives
Required Qualifications And Experience
Qualifications
Minimum 3+ years of experience in handling team (lead) in Security operations center
Work Experience
Strong hands-on experience on Microsoft Sentinel incident handling including Azure IAM, Key vault, WAF, EDR, CSPM & CWP.
Strong knowledge & experience on alert correlation aspect
Sensible on organization risk, IT risk & impact analysis.
Experience in Project management.
Positive attitude, Hard Worker and team player
Certifications like CEH (Ethical Hacking), Azure/AWS Security, ISO 27001 is mandatory

Work arrangement
No