Lead SOC Incidence Response Analyst at Interswitch

The Lead SOC Incident Response Analyst will be responsible for driving and maturing the organization’s cyber incident response program. This role ensures timely detection, investigation, containment, and recovery from security incidents across cloud and on-premise environments.

Responsibilities

• Drive the organization’s security incident response program, ensuring the detection, analysis, containment, eradication, and recovery from cyber incidents across cloud and on-premise environments.
• Lead and support a team of security analysts and engineers during active investigations and escalations.
• Develop and continuously refine incident response playbooks, ensuring alignment with MITRE ATT&CK and NIST 800-61 standards.
• Coordinate cross-functional incident response activities with IT, Engineering, Legal, Compliance, and Communications teams.
• Conduct root cause analysis and post-incident reviews to identify control gaps, recommend mitigation strategies, and track long-term remediation.
• Implement threat intelligence correlation and alert enrichment to improve detection fidelity and reduce response time.
• Maintain the organization’s incident register and deliver executive-level reporting on incident trends, KPIs, and risk reduction outcomes.
• Drive tabletop exercises and red/blue team simulations to strengthen preparedness and response capabilities.
• Collaborate with security engineering teams to improve detection and automate common triage workflows.

Role Requirements

• Bachelor’s degree in Computer Science, Information Security, or related field (advanced degree or equivalent experience is a plus).
• 7+ years of hands-on experience in SOC operations, cyber incident response, or threat detection (with at least 2 years in a senior or lead capacity).
• Strong knowledge of incident response lifecycle (detection, analysis, containment, eradication, recovery) across cloud and on-prem environments.
• Deep familiarity with industry frameworks (MITRE ATT&CK, NIST 800-61).
• Proven ability to lead and coordinate cross-functional incident response efforts with IT, Engineering, Legal, and Compliance teams.
• Proficiency with SIEM, SOAR, EDR, and threat intelligence platforms; ability to enrich alerts and reduce response times.
• Skilled in log analysis, malware/network forensics, and root cause analysis.
• Experience developing and executing tabletop exercises, simulations, and playbooks.
• Excellent communication skills with a track record of preparing executive-level reports and delivering clear incident insights.
• Professional certifications preferred: GCIH, GCFA, GNFA, CISSP, CISM, OSCP, or equivalent.