Principal Architect - Security

Time Zone : Should be flexible working in PST/EST hours

Deliverables Key Responsibilities

o Manage and successfully deliver ISSQUARED SOC services to external customers in a shared or dedicated model.

o Leadership and Management of the SOC team including hiring, developing & retaining personnel, workload assignment, process development, project management

o Work with sales and pre-sales teams to develop and present the SOC and other cyber security offerings to potential customers.

o Develop standard operating procedures and other appropriate documents to enforce quality and consistency of Security services being delivered.

o Stay in touch with the latest exploits and fixes and be tuned to lead the team on effective zero-day exploit situations.

o Analyse event streams from the SIEM tools and recommend/implement optimum tuning features to ensure that analysts and agents are not loaded with a high number of false positives.

o Able to technically design, manage & configure

SIEM tools like QRADAR, Crowdstrike, FortiSIEM, Microsoft Sentinel.

Firewalls & IDS/IPS solutions

VAPT tools and processes

o Adherence to all SLAs and committed to the principle of zero events being missed.

o Setup, lead and drive to closure SSIRT calls, lead forensic analysis activities with on-shore counterparts and other technical managers/leads.

o Work closely with other teams like the NOC, L3 escalation support teams to drive cohesive responses to major issues.

o Identify custom reporting requirements, translate requirements into SIM technical specifications.

o Ensure shifts are staffed appropriately and right resources are recruited as per business needs.

o Contribute to improving the delivery processes and metrics.

o Contribute to training and development of documentation required to support the service.

o Work closely with engineering teams to refine the monitoring solutions and processes deployed leading to efficiencies.

o Be able to create dashboards and reports, set up calls with customers and present daily, weekly and monthly trends and performance statistics.

Essential Attributes and Skills Needed:

o Fluency in spoken and written English with minimal or no MTI influence.

o Bachelors degree in Science or higher. (B.E/B.Tech preferred).

o In-depth knowledge of security concepts such as Cyber-attacks and techniques, threat vectors, risk management, incident management etc.

o Experience in security device Management and SIEM tools

o Knowledge of applications, databases, middleware to address security threats against the same.

o Proficient in preparation of reports dashboards and documentation.

o Good Analytical skills, problem solving and Interpersonal skills.

o Solid and demonstrable comprehension of information security including malware, emerging threats, attracts, and vulnerability management

o Experience with reviewing raw log files, data correlation, and analysis (i.e firewall, network flow, IDS, system logs) including integration and workflow experience with Security automation and orchestrations platforms.

o Subject matter expert(SME) in one or multiple areas such as Windows, UNIX, mid-range, mainframe, firewalls, intrusion detection, Endpoint Detection and Response, threat detection analysis and /or information risk management.