TECHNICAL LEAD - SOC 2

Role overview

TECHNICAL LEAD - SOC 2 at Happiest Minds

Responsibilities

• Analyze the potential impact of threats on the Group's infrastructure, applications, users, and data.
• Ensure threat intelligence-driven response activities are tracked, actioned, and closed.
• Ensure continuous updating of playbooks based on evolving threat landscapes and operational lessons learned.
• Provide early warnings on advanced persistent threats (APTs), ransomware groups, and significant actors.
• Support threat hunting activities based on high-fidelity threat intelligence and emerging threat patterns.
• Maintain and update threat intelligence feeds (commercial, open-source, and internal).
• Perform platform upgrades, patches, and system tuning.
• Ensure high availability and business continuity configurations are in place.
• Manage user access, roles, and permissions according to governance policies.
• Conduct quarterly access reviews.
• Develop and maintain integration of playbooks and dataflow documentation.

Employment details

• Location: Bengaluru

Additional role details

• Threat Intelligence and Advisory Management Threat Sources Covered Monitor, aggregate, and analyze threat intelligence and advisories from multiple sources, including but not limited to: Commercial Threat Intelligence Platforms (e.g., Anomali, Recorded Future) Vendor Security Advisories (e.g., Microsoft, Cisco, Palo Alto, Akamai) Government and CERT Alerts (e.g., UAE CERT, US-CERT, ENISA) Threat feeds from SOC and SIEM/SOAR platforms Crowd-sourced threat platforms and Bug Bounty findings (e.g., Bugcrowd) Open-source intelligence (OSINT) sources Dark Web intelligence sources (where applicable) Internal threat hunting findings Partner advisories and industry-specific alerts.
• General Service Requirements Maintain continuous monitoring and validation of incoming threat intelligence.
• Prioritize threat advisories based on business relevance, criticality, and risk exposure.
• Provide actionable threat advisories with mitigation recommendations.
• Integrate threat intelligence outputs with SOC, Incident Response, and Vulnerability Management processes.
• Develop and maintain threat advisory and intelligence playbooks for standardized processes.
• Threat Detection and Collection Collect and normalize threat advisories and intelligence feeds.
• Validate the authenticity and credibility of threat sources.
• Remove noise and false positives to focus on credible and impactful threats.
• Threat Analysis and Prioritization Perform enrichment on threat data using internal telemetry and external datasets.
• Correlate identified threats with the Group's asset inventory and critical systems.
• Prioritize threats based on risk to the business (high, medium, low impact).
• Threat Advisory Notification and Actioning Prepare clear, actionable threat advisories including: Threat description Potential impact Affected systems/services Recommended immediate and long-term mitigation actions Disseminate advisories to relevant stakeholders (e.g., IT, Security Operations, Business Units).
• Raise Threat Advisory Tickets (TA Tickets) where action is required.
• Assign and track closure of mitigation actions within agreed timelines.
• Threat Intelligence Playbooks Develop structured playbooks for threat collection, validation, analysis, dissemination, and response.
• Align playbooks with MITRE ATT&CK, NIST, and other cybersecurity frameworks where applicable.
• Threat Campaign Monitoring Identify ongoing threat campaigns targeting the Group's sector or geography.
• Recommend preventive and defensive measures based on observed campaigns.
• Threat Hunting Support Use threat intelligence to proactively identify indicators of compromise (IoCs) and tactics, techniques, and procedures (TTPs) that could already exist in the environment.
• Threat intelligent Platform Management & Operations Perform daily, weekly, and monthly operational health checks.
• Monitor and manage platform performance and storage utilization.
• Enable role-based dashboards for SOC, IR, Threat Hunting, and Management.
• Integrate various threat intelligence feeds (e.g., STIX/TAXII, MISP, ISACs).
• Validate, de-duplicate, and normalize intelligence data.
• Prioritize threat indicators based on relevance to the organization.
• Regular review and curation of feeds for noise reduction and enrichment.
• Integrate TIP with SIEM (e.g., QRadar, Splunk), SOAR, EDR, firewall, and other security controls.
• Automate indicator enrichment and correlation in SOC tools.
• Enable automated blocking of high-confidence IOCs in firewalls or proxy solutions.