Director of Cyber Security Operations

Location: Bengaluru

Director of Cybersecurity Operations
Location :
India - NCR/Bangalore/Remote
About the Role  : HCL Software is seeking an accomplished security leader as Director of Cybersecurity Operations to head our cybersecurity operations organization. This role owns four pillars of our defensive and offensive security program:
Function Scope Security Operations Center (SOC) 24×7 monitoring, detection, triage, and incident response SOC Engineering Detection engineering, SIEM/SOAR platform ownership, automation, and telemetry pipeline management Vulnerability Management (VM) CTEM, Enterprise-wide exposure identification, risk-based prioritization, and remediation governance Red Team Adversary emulation, offensive testing, and purple-team collaboration with defenders As Director, you will have full ownership of the cybersecurity operations charter: the people (four teams and their leaders, including hiring, development, and succession), the platforms (the SIEM/SOAR/EDR ecosystem and the vulnerability and offensive-security tooling stack), the budget (headcount, tooling, and vendor/MSSP contracts), and the outcomes (detection and response performance, exposure reduction, and validated resilience against real-world attack techniques).

You own the operational results end to end and are the accountable voice for them to the CISO and executive leadership. You will lead the continuous maturation of the SOC from a reactive, alert-driven operation toward a proactive, intelligence-led, and engineering-driven function. Establish and execute a maturity roadmap benchmarked against recognized models (e.g., SOC-CMM, NIST CSF), with measurable milestones across people, process, and technology.

Key Responsibilities Strategy & Leadership

• Own the multi-year strategy, roadmap, budget, and SOC, SOC Engineering, Vulnerability Management, and Red Team functions.

• Lead the leadership transition: retain institutional knowledge, stabilize the team, and build succession depth across all four pillars. HCL Software – Internal 1

• Hire, develop, mentor, and retain senior security talent; manage managers and build career paths that reduce burnout and attrition.

• Report security posture, operational metrics, and incident status to the CISO, executive leadership, and (as needed) the board — translating technical risk into business terms. Security Operations & Detection

• Drive continuous improvement of detection and response: reduce mean time to detect/respond (MTTD/MTTR), dwell time, false-positive rates, and alert fatigue.

• Evaluate and govern the responsible adoption of AI/agentic capabilities in the SOC (AI-assisted triage, investigation summarization, automated enrichment) while maintaining human oversight for consequential decisions.

• Own major incident command: lead cross-functional response with IT, engineering, legal, communications, and customer-facing teams; run post-incident reviews and drive lessons learned to closure.

• Assess current-state SOC maturity and publish a multi-year target-state roadmap with quarterly milestones, reporting progress to the CISO.

• Advance detection maturity: move from vendor-default rules to a threat-informed detection engineering lifecycle with MITRE ATT&CK coverage mapping, detection-as-code, versioning, and automated testing.

• Mature triage and response through tiered playbook standardization, SOAR-driven automation of repeatable tasks, and progressive elimination of low-value manual work.

• Evolve metrics from activity-based (alert counts, tickets closed) to outcome-based (MTTD/MTTR, dwell time, detection coverage %, automation rate, true-positive ratio) and use them to drive investment decisions. SOC Engineering & Platform

• Own the SIEM/SOAR/EDR/NDR ecosystem strategy: telemetry…