Assistant Vice President - Security Incident Management Lead

Role Purpose :
Responsible for developing and running end-to-end program for managing the security incident life-cycle of all kind of Information Security Incidents including Information Governance & Security, getting routine investigation, forensics & eDiscovery etc. done in association of in-house team and service partners.

Role Accountability
Oversee the monitoring, identification and resolution of security incidents to detect threats through analysis, investigations and prioritization of incidents based on risk exposure
Develop and manage Incident Management program including monitoring, review, triage, assessing impact, diagnostic and data collection, troubleshooting and remediation, interacting with requestors etc.
Develop and maintain an incident response management program that includes incident detection, analysis, containment, eradication, recovery and chain of forensic artifacts required for additional investigations
Lead the implementation and sustenance of security incident response plan and associated playbooks for all security related incidents
Oversee SBIC incident response tools and processes, covering proactive planning and prevention, as well as reactive detection and remediation
Manage Information Security Incidents including assessment, quantification, investigation and mitigation including liaison with IT teams and other business functions.
Record and classify received Incidents and undertake an immediate effort in order to restore a service/reach resolution stage as quickly as possible
Report incidents to the regulator (RBI) as per the mandate
Develop and manage metrics and report on the effectiveness of the security incident response program which includes reports to leadership
Work with multiple internal and external stakeholders to drive triage, analysis, containment, and eradication of the incidents and provide leadership in high-risk incidents
Participate in various internal and external audits in context of security incident response program
Drive continuous improvements in people, process, and technology as it relates to the efficiency and effectiveness of the security incident response program
Define Policy and process for Security Incident Management including defining roles and responsibilities
Define Cyber Crisis management plan and conduct Cyber Crisis management drills at regular intervals involving IT and business stakeholders
Monitor, respond, and report compliance to SLA's and managing security incidents related to IT systems covered under security programs like SIEM, DLP, Anti-Phishing Brand and Dark-Web Monitoring.
Assess Security Incidents and lay down strategies to reduce the likelihood of future occurrences

Measures of Success
Incident Management Program as per approved policy and regulatory requirements
Timely and accurate reporting of Incidents to regulator (RBI)
Logging, responding and closure of Incidents as per agreed SLA
No adverse observation in Internal/external audits
Increase in maturity of Security Incident Management operating model
Effective root cause analysis and remediation for identified security incidents
Timely and accurate publication of MIS / Business dashboards
Publication of Incident report as per the prescribed format within the agreed timeframe
Process Adherence as per MOU

Technical Skills / Experience / Certifications
In-depth knowledge of security concepts such as cyber-attacks, threat vectors, best practices, risk and incident management etc.
Information security experience, with a very strong technical background and significant security Incident response experience
Understanding of Security Terminology i.e. Network Security, Vulnerability, Anti-Virus, Virus/Trojans/Spam/Attack Pattern
Understanding of configuration and security controls of various information technology and security infrastructure components deployed on prem and cloud
Experience in handling various types of incidents like phishing, denial of service, malware, and unauthorized access etc.
Understanding of Security Information and Event Management (SIEM), Data Loss Prevention (DLP) and security incident response workflow management technologies.
Understanding of related BFSI regulations and its relevance to security incident management

Experience with and confidence to develop and socialize security operations playbooks across infrastructure and applications teams in IT
Strong understanding of security incident management lifecycle including CERT/SIRT and/or MITRE attack framework
At least one Industry-standard certifications such as CEH, CHFI, GIAC etc.

Competencies critical to the role
Stakeholder Management.
Problem Solving & Analytical ability.
Process Orientation, teamwork and collaboration.

Qualification
Bachelor’s degree /

B.Tech. in Computer Science / IT or any other relevant discipline

Preferred Industry
BFSI / NBFC /E-commerce/IT & ITES / Telecom.