SO Professional

Review the SOC architecture, design, Integration, dataflow, use cases etc

Manage the SOC service provider and ensure SOC function is aligned with business objectives

Incident analysis and quality validation on triage by L1/L2 resources for both SOC and VA PT activities

Provide inputs to Content Management Team for enhancements of Use Cases and incident lifecycle

Document play books for threat scenarios and ensure they are followe'd for relevant offences incident management

Enable SOC to comply with regulatory internal audit requirements and work on all audit observations and ensure timely closure of the same

Regularly review all SOC SOPs and update the same

Review and validation of incident closed by L1/L2 team due to inaccurate/insufficient information

Provide direction on Rules Use cases creation, fine-tuning and management for all modules of SOC solutions

Manage end-to-end life cycle of use cases deployment in SIEM solution

Coordinate with concern teams for onboarding of right set of log sources

Ensure right set of effective rules are configured to detect threat, including but not limited to, cyber kill chain, detect OWASP top 10, SANS top 20, any unauthorized movement or access from outside to inside, inside to outside and within network (lateral movement), any attempt of executing unauthorized PowerShell execution, DNS tunneling, data exfiltration, attempt of privilege escalation, use of known rootkits etc

Define and review the SOC KPIs and provide management reports

Incident management by leading the Forensics investigation of critical incidents

Provide technical input to other teams and Top Management on SOC and Information Security related requirements