IT security Manager (2nd line)

About the role

This is a 2nd Line Security Incident Response role focused on investigating and validating security alerts, performing advanced analysis of suspicious activities, managing vulnerabilities, and supporting security compliance and capability building across the organisation.

Key responsibilities

• Investigate and validate security alerts from L1/SOC, perform triage, severity classification, and drive incident handling to closure
• Support and lead high-severity incident response with evidence collection, containment, and recovery tracking
• Conduct incident post-mortems and ensure remediation actions are implemented
• Perform advanced analysis of suspicious activities using SIEM/SOAR/EDR and related telemetry
• Improve detection quality through rule tuning, correlation logic enhancements, and false-positive reduction
• Review vulnerability scan results, assess risk, and align remediation priorities with asset criticality
• Track patching and mitigation efforts, verify remediation, and close exceptions where applicable
• Support implementation of security controls such as access control, log auditing, encryption, and security baselines
• Maintain and improve playbooks, investigation guides, and incident handling procedures
• Coordinate with Network, Systems, Application, IAM, and Infrastructure teams to resolve security issues end-to-end

About you

• 3–8+ years of hands-on experience in information security, SOC, incident response, vulnerability management, or security operations
• Strong understanding of common attack techniques and incident investigation workflows (e.g., kill chain concepts, lateral movement, persistence)
• Practical knowledge of log analysis and basic forensics (Windows/Linux/system/network logs correlation)
• Proficiency with at least one major security operations platform (SIEM, EDR, or vulnerability management platforms)
• Familiarity with vulnerability remediation lifecycle (risk assessment, prioritization, validation)
• Working knowledge of security and compliance frameworks (e.g., ISO 27001, NIST, or equivalent)