Job Opportunities API

You will own the end-to-end incident response lifecycle at CP Axtra — from detection and triage through containment, eradication, and recovery, all the way to post-incident review and capability improvement. You are the Incident Commander during major security events, the person in the war room making real-time decisions about containment actions, stakeholder communications, and escalation paths. Beyond crisis response, you'll build and mature the incident response programme itself. This means developing playbooks tailored to CP Axtra's specific threat scenarios (ransomware hitting POS systems, credential stuffing on the e-commerce login, insider threats in finance systems), running realistic tabletop exercises, and driving post-incident reviews that produce actual operational improvements — not just reports that gather dust. You'll manage the SOC team's operational effectiveness, own the KPIs that matter (MTTD, MTTR, false positive rates), and work closely with the Security Architect and GRC teams to ensure lessons learned feed back into both technical controls and governance processes. Key Responsibilities: ·       Serve as Incident Commander for all Severity-1 and Severity-2 security incidents — lead war rooms, make containment decisions, coordinate cross-functional response, and manage executive communications ·       Build and maintain the incident response playbook library — at least 15 scenario-specific playbooks covering ransomware, data exfiltration, credential compromise, DDoS, insider threat, cloud breach, and supply chain compromise ·       Drive post-incident reviews (PIRs) for every significant incident, producing root cause analyses with specific, tracked remediation actions — not generic recommendations ·       Own and improve SOC operational KPIs: MTTD < 30 minutes, MTTR < 4 hours for critical incidents, false positive rate < 20% on high-priority alerts ·       Design and execute quarterly tabletop exercises and annual red team/purple team engagements, measuring response effectiveness and identifying capability gaps ·       Manage relationships with MSSP/MDR providers — review SLAs, escalation performance, and detection quality monthly; hold them accountable to contractual commitments ·       Develop and maintain the incident communication framework — pre-drafted templates for executive briefings, customer notifications, regulatory reports (PDPA breach notification), and media holding statements ·       Coordinate with legal, compliance, and communications teams during incidents that have regulatory, legal, or public-relations implications ·       Maintain the threat intelligence integration pipeline — ensure IOCs and TTPs from threat feeds are operationalised into detection rules within 24 hours ·       Build incident response capabilities in the SOC team through structured skill development, scenario-based training, and mentoring Requirements ·       EDR/XDR: Cortex XDR, CrowdStrike Falcon — investigation, threat hunting, and response actions ·       SIEM/SOAR: Splunk, Microsoft Sentinel, or equivalent — log analysis, correlation rules, automated playbooks ·       Forensics: Disk and memory forensics tools, network packet analysis — enough to guide investigations and validate findings ·       Threat intelligence: MISP, commercial threat feeds — IOC management and operationalisation ·       Cloud investigation: GCP, Azure, AWS — cloud-native logging (CloudTrail, Activity Log, Audit Log) and inves