Assistant Manager - Cybersecurity Operations

Incident Handling Analysis

Take over prioritized alerts from L1 and perform detailed analysis of suspicious or confirmed incidents

Conduct deep-dive investigations using logs, correlation rules, and threat intelligence

Validate critical alerts true positive or false positive

Identify attack patterns such as lateral movement, persistence, and privilege escalation

Provide clear, actionable insights along with containment and remediation recommendations for critical alerts

Investigation Evidence Management

Provide audit-ready log evidence and maintain proper investigation artifacts

Perform cross-correlation analysis (including advanced analytics like RhythmX in LogRhythm)

Deliver detailed investigation reports with timelines and impact assessment

Proactive Detection

Perform IOC-based and deep-analysis using IOC/ pattern to detect anomalies

Identify hidden or undetected threats beyond existing correlation rules and suggest L3 team on creation

Recommend and implement new detection use cases and rule enhancements

Use Case Tuning Optimization

Fine-tune rules suggestion to L3 to reduce noise and improve detection efficiency

Continuously improve alert accuracy by minimizing false positives and false negatives

Log Source Platform Support

Supporting log management activities including archival and restoration

Work with L3 if needed to troubleshoot log ingestion issues (missing logs, delays, parsing failures)

Ensure proper log normalization and data availability for analysis

Incident Response Support (Critical Cases)

Recommend and guide containment actions such as:

Process Improvement Documentation

Create and maintain playbooks, SOPs, and investigation procedures

Ensure documentation is up to date for operational consistency

Quality Assurance L1 Enablement

Review and validate L1 escalations and tickets for accuracy and completeness

Provide feedback and guidance to improve L1 monitoring and detection quality

Collaboration Escalation Management

Act as a bridge between L1 (monitoring team) and L3 (SME/support teams)

Coordinate effectively for issue resolution, escalations, and platform improvements