Source description
About the role
Role Purpose Lead cybersecurity shared services across 15–20 group companies of the customer. Drive world class Cybersecurity operations. Overall ownership and accountability to keep all the group companies safe and secure through proactive threat identification and resolution, AI- driven automation, and rapid incident management. Location Hyderabad or Mumbai; Flexibility to travel to various locations as required Key Responsibilities Lead world-class Cybersecurity operations covering SOC, Threat Intelligence, Threat Hunting, Incident Response, EDR, Vulnerability Management, Identity and Privilege Access Management, Network Security, Cloud Security and Data Security Establish common security standards, governance and KPIs across group companies Lead security platform strategy, implementing and managing the various tools and platforms Drive AI-enabled SOC transformation to accelerate threat detection, triage and automated containment Manage major cyber incidents, ransomware response and cyber recovery Build and mentor high-performing cybersecurity teams. Be the key leader to represent the Cyber operations to the customers and internal management Serve as a single point of contact for customer escalations; prepare remediation plans and track it to closure Guide teams for advanced use case development leveraging all product features (trends + variables + hierarchal architectures, Pattern Discovery) Oversee security event triage and incidents investigations, including support for forensics analysis. Responsible for security incident response and documentation of major investigation reports Maintain an expert understanding of vulnerabilities - response, and mitigation strategies used to support cyber security operations Work closely with all Operations staff including those across locations in India to ensure 24x7 availability. Work in a multi-supplier environment and appropriately handle risks to TCS delivery commitments Ensure periodic reporting to customer leadership and TCS leadership on Operational performance Key Skills 18+ years in cybersecurity operations with 8+ years in leadership roles. Strong experience in leading and managing large teams delivering Cybersecurity operations and delivering world-class operations exceeding customer expectations Core skills include SOC, Threat Intelligence, Threat Hunting, Incident Response, EDR, Vulnerability Management, Identity and Privilege Access Management, Network Security, Cloud Security, Data Security and AI for Security Operations Good knowledge & experience with Security solutions such as SIEM, Firewalls, WAF, IPS, Identity Management including Privileged Identity, Email Gateway, Encryption, Antivirus, EDR, NDR. Experience should include on-premise, cloud and hybrid deployment models. Experience in deploying and using MS tools, CrowdStrike tools and Palo Alto tools Experience in Security Incident Response Lifecycle with a good understanding of Cyber Kill Chain & Mitre ATTACK frameworks Experience in defining SOC usecases and guiding the time in operationalizing them through SOPs, and SIEM based alerts / reports. Good understanding of Vulnerability Management process including executive reporting and remediation tracking Experience in understanding and interpreting Threat intelligence from various external sources including validation of related IOCs in customer environment Familiarity with NIST, ISO 27001, and relevant data privacy/regulatory requirements Good experience in ITIL based Service Management Strong analytical and problem-solving skills Excellent verbal and written communication skills Experience in directly working with the Executive management - CISOs, BISOs, CDIOs CIOs, Board members and providing situational analysis and articulating current and emerging threats Industry recognized certifications and tool certifications will be an added advantage