Job Title:  T&T | Cyber: D&R | Manager | Incident Response & Handling | Hyderabad

Your potential, unleashed.

India’s impact on the global economy has increased at an exponential rate and Deloitte presents an opportunity to unleash and realise your potential amongst cutting edge leaders, and organisations shaping the future of the region, and indeed, the world beyond.

At Deloitte, your whole self to work, every day. Combine that with our drive to propel with purpose and you have the perfect playground to collaborate, innovate, grow, and make an impact that matters.

The team

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks.

Summary

The role requires providing expertise and leadership for Incident Response capabilities including good understanding of cyber incident forensics. It requires providing both subject matter expertise and project management experience to serve as the “point person” of client engagement in domain.

The candidate shall pertain efficient incident response and remediation skills to minimise the impact of cyber risks. The individual will oversee and support security monitoring operations team and assist them during security incidents and ensure incidents are managed and responded effectively including and reporting to stakeholders. This role primarily consists of leading team of the Incident responders, Incident managers and stakeholders (including client, vendors, etc.) and to conduct thorough response activities on behalf of a wide variety of clients across sectors.

Candidate is required to work in complex security environments and alongside SOC team to design, communicate and execute incident response, containment and remediation plans. Candidate is required to have hands-on experience of incident management and investigation tools and shall be comfortable leading teams on challenging engagements, communicating with clients, providing hands-on assistance with incident response activities, and creating and presenting high-quality deliverables.

Skills required

• Responding to alerts from across the entire global technology and information estate to quickly detect harmful behaviours and events, containing, mitigating, and remediating minor incidents and in coordination with the Cybersecurity Incident Management and Response Team, effectively containing, mitigating, and remediating more serious events.   
• Supporting cyber security incidents through to eradication and feed into the Post Incident Review process that delivers detailed analysis on the root cause of incidents investigated and produces findings and recommendations that support control adjustments to better protect the bank.
• Identifying, developing, and implementing new detections (Use cases) and mitigations (Playbooks) across the security platforms.
• Reviewing and approving new Use Cases and Playbooks created by Cybersecurity colleagues.
• Continuously reviewing the effectiveness of analysis playbooks, processes, and tooling.
• Communicating new use cases (go-live, demise, tuning), to the cybersecurity operations teams, supporting the Cybersecurity Operations Manager in ensuring all teams are prepared to take on the additional workload and have sufficient tools, training, and capability to do so effectively.
• Researching emerging threats and vulnerabilities to aid in the identification of cyber incidents.
• Applying structured analytical methodologies to maximise threat intelligence growth and service efficacy.
• Supporting the Crew Leads during shift handovers, ensuring all team members are ready to manage ongoing incidents.
• Supporting the triage of potentially malicious events to determine severity and criticality of the event.
• Provide expert-level advice and technical leadership to the team, driving the continued evolution of hunting, monitoring, detection, analysis and response capabilities and processes.
• Train, develop, mentor, and inspire cybersecurity colleagues in area(s) of specialism.
• Collaborate with the wider Cybersecurity (and IT) teams to ensure that the core, underlying technological capabilities that underpin an effective and efficient operational response to current and anticipated threats and trends remain fit for purpose.
• Identify processes that can be automated and orchestrated to ensure maximum efficiency of Global Cybersecurity Operations resources.
• Promote a “self-critical” and continuous assessment and improvement culture whereby identification of weaknesses in the bank’s control plane (people, process, and technology) are brought to light and addressed in an effective and timely manner.
• Support engagement in support of Global Businesses and Functions to drive a global up-lift in cyber-security awareness and help to evangelise Cybersecurity efforts and success.

Requirements:

To be successful in this role, you should meet the following requirements:

• 5+ years of technical experience in IT or IT Security, for example as a network or operating system administrator.
• Expert level knowledge and demonstrated experience of common log management suites, Security Information and Event Management (SIEM), EDR, Email Protection, Case Management & other cyber security tools.
• Expert level knowledge and demonstrated experience of common cybersecurity technologies such as IDS / IPS / HIPS, Advanced Anti-malware prevention and analysis, Firewalls, Proxies, MSS, etc.
• Good knowledge and technical experience of 3rd party cloud computing platforms such as AWS, Azure, and Google.
• Good knowledge and demonstrated experience of common operating systems and platforms to include Windows, Linux, UNIX, Oracle, Citrix, GSX Server, iOS, OSX, etc.
• Good knowledge of common network protocols such as TCP, UDP, DNS, DHCP, IPSEC, HTTP, etc. and network protocol analysis suits.
• Functional knowledge of scripting, programming and/or development of bespoke tooling or solutions to solve unique problems.
• Good knowledge of key information risk management and security related standards including OWASP, ISO2700x series, PCI DSS, GLBA, EU data security and privacy acts, FFIEC guidelines and NIST standards
• Good knowledge and demonstrated experience in incident response tools, techniques and process for effective threat containment, mitigation, and remediation.  
• Formal education and advanced degree in Computer Science or similar and/or commensurate demonstrated work experience in the same.
• CEH, EnCE, SANS GSEC, GCIH, GCIA CISSP or any similar Certifications.

How you’ll grow 

Connect for impact 

Our exceptional team of professionals across the globe are solving some of the world’s most complex business problems, as well as directly supporting our communities, the planet, and each other. Know more in our Global Impact Report and our India Impact Report. 

Empower to lead 

You can be a leader irrespective of your career level. Our colleagues are characterised by their ability to inspire, support, and provide opportunities for people to deliver their best and grow both as professionals and human beings. Know more about Deloitte and our One Young World partnership. 

Inclusion for all 

At Deloitte, people are valued and respected for who they are and are trusted to add value to their clients, teams and communities in a way that reflects their own unique capabilities. Know more about everyday steps that you can take to be more inclusive. At Deloitte, we believe in the unique skills, attitude and potential each and every one of us brings to the table to make an impact that matters.  

Drive your career 

At Deloitte, you are encouraged to take ownership of your career. We recognise there is no one size fits all career path, and global, cross-business mobility and up / re-skilling are all within the range of possibilities to shape a unique and fulfilling career. Know more about Life at Deloitte. 

Everyone’s welcome… entrust your happiness to us     

Our workspaces and initiatives are geared towards your 360-degree happiness. This includes specific needs you may have in terms of accessibility, flexibility, safety and security, and caregiving. Here’s a glimpse of things that are in store for you.   

Interview tips 

We want job seekers exploring opportunities at Deloitte to feel prepared, confident and comfortable. To help you with your interview, we suggest that you do your research, know some background about the organisation and the business area you’re applying to. Check out recruiting tips from Deloitte professionals. 

*Caution against fraudulent job offers*: We would like to advise career aspirants to exercise caution against fraudulent job offers or unscrupulous practices. 

At Deloitte, ethics and integrity are fundamental and not negotiable.  We do not charge any fee or seek any deposits, advance, or money from any career aspirant in relation to our recruitment process.  We have not authorized any party or person to collect any money from career aspirants in any form whatsoever for promises of getting jobs in Deloitte or for being considered against roles in Deloitte. We follow a professional recruitment process, provide a fair opportunity to eligible applicants and consider candidates only on merit. No one other than an authorized official of Deloitte is permitted to offer or confirm any job offer from Deloitte.  We advise career aspirants to exercise caution. 

In this regard, you may refer to a more detailed advisory given on our website at: https://www2.deloitte.com/in/en/careers/advisory-for-career-aspirants.html?icid=wn_