Manager - Consulting Implementation

Role overview

Manager - Consulting Implementation at KPMG

The role oversees Incident Response, Threat Hunting, Threat Intelligence, Threat Detection Engineering, and SOC operations while driving continuous improvement of security monitoring capabilities and cyber defense strategies. 1.

Responsibilities

• Develop and implement SOC processes, procedures, and operational metrics.
• Drive operational excellence through process optimization and automation.
• Manage SOC analysts, incident responders, and threat hunters. 2.
• Coordinate containment, eradication, recovery, and post-incident reviews.
• Develop and maintain Incident Response Plans, Playbooks, and Runbooks.
• Conduct root cause analysis and lessons learned exercises.
• Collaborate with legal, compliance, IT, and executive leadership during major incidents. 3.
• Develop threat-hunting hypotheses based on intelligence and adversary tactics.
• Analyze emerging threats, adversary tactics, techniques, and procedures (TTPs).
• Track global threat actors, vulnerabilities, and industry-specific cyber risks. 5.
• Develop SIEM detection rules, correlation searches, and analytics.
• Work with threat hunters and incident responders to enhance visibility and detection coverage. 6.
• Ensure log onboarding, normalization, and retention requirements are met.
• Monitor cloud, endpoint, network, and application security events.
• Drive automation and orchestration initiatives to improve SOC efficiency. 7.
• Conduct performance reviews and training programs.
• Build career development and succession plans within the SOC team.

Preferred qualifications and skills

• Experience with cloud security monitoring and multi-cloud environments preferred.

Employment details

• Location: Mumbai [Maharashtra] [India]

Additional role details

• The SOC Manager is responsible for leading and managing the organization's Security Operations Center (SOC), ensuring effective monitoring, detection, investigation, response, and remediation of cybersecurity threats.
• Security Operations Management Lead and manage 24x7 SOC operations and security monitoring activities.
• Ensure timely triage, analysis, escalation, and resolution of security incidents.
• Incident Response Lead cyber incident response activities for security breaches, malware, ransomware, phishing, insider threats, and advanced persistent threats (APTs).
• Threat Hunting Build and mature proactive threat hunting capabilities.
• Perform endpoint, network, cloud, and log-based threat hunting activities.
• Identify stealthy threats, attacker behaviors, and indicators of compromise (IOCs).
• Recommend detection improvements from hunting findings. 4.
• Threat Intelligence Establish and manage Cyber Threat Intelligence (CTI) programs.
• Integrate threat intelligence feeds into SOC operations and SIEM platforms.
• Produce actionable intelligence reports for technical and leadership teams.
• Threat Detection Engineering Design, implement, and continuously improve threat detection use cases.
• Tune alerts to reduce false positives and improve detection effectiveness.
• Map detections to MITRE ATT&CK framework.
• Security Monitoring & SIEM Management Manage SIEM, EDR, NDR, SOAR, and Threat Intelligence platforms.
• Risk, Compliance & Reporting Support compliance frameworks such as ISO 27001, NIST CSF, PCI DSS, CIS Controls, SOC2, and GDPR.
• Report cybersecurity posture, KPIs, KRIs, and incident trends to senior management.
• Participate in audits, assessments, and regulatory reviews. 8.
• Team Leadership Mentor and develop SOC analysts and cybersecurity professionals.
• Foster a culture of continuous learning and operational excellence. 8+ years of Cybersecurity experience. 3–5+ years of SOC leadership or managerial experience.
• Experience managing enterprise SOC environments and incident response engagements.
• SIEM: Microsoft Sentinel, Splunk, QRadar, ArcSight, LogRhythm EDR/XDR: Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black SOAR: Palo Alto XSOAR, Splunk SOAR, Microsoft Sentinel Automation Threat Intelligence Platforms (TIP) Network Security, IDS/IPS, Firewall