Deputy Unit Manager - Information Security

Bajaj Finance; Pune District; On-site; INR 700,000 - 1,100,000; Full time

Job summary

Bajaj Finserv Limited seeks a skilled SOC L1 Engineer to join the information security team. You will handle incident response governance, monitor alerts, triage and escalate as needed, and maintain accurate incident records across the SOC lifecycle.

You will work in a 24x7 rotating shift model, coordinating with incident response teams and ensuring compliance with SLAs and regulatory requirements. Certifications like CEH and ISO 27001 are preferred.

Qualifications

• Minimum 3+ years leading a Security Operations Center team.
• Hands-on experience with Microsoft Sentinel incident handling.
• Experience with Azure IAM, Key Vault, WAF, EDR, CSPM/CWP.
• Strong alert correlation knowledge.
• Experience in project management.
• CEH, Azure/AWS Security, ISO 27001 certification mandatory.

Responsibilities

• Role: The SOC L1 Engineer is responsible for Security Operations and Incident Management, performing continuous monitoring and alert handling activities across the SOC lifecycle.
• The SOC L1 Engineer serves as the first line of defense for security monitoring, validating alerts and escalating threats to higher tiers.
• Maintain incident records, document findings, and ensure timely communication across the incident lifecycle.
• Work in rotational shifts to provide 24x7 monitoring and rapid response.

Skills

Microsoft Sentinel

Azure IAM

Key Vault

WAF

EDR

CSPM/CWP

Alert correlation

Risk analysis

Project management

CEH

Azure Security

AWS Security

ISO 27001

Tools

Microsoft Sentinel

Job description

Job Purpose

Information security team member who is proficient in handling of Incident response maintain Incident response governance in SOC lifecycle.

Duties and Responsibilities

• Role: The SOC L1 Engineer is responsible for Security Operations and Incident Management, performing continuous monitoring and alert handling activities across the SOC lifecycle. The role ensures that security alerts and events are analyzed, triaged, investigated, categorized, escalated, and closed in a consistent, auditable, and risk-aligned manner, in accordance with established SOC processes, policies, SLAs, and regulatory requirements.
• The SOC L1 Engineer serves as the first line of defense for security monitoring, validating alerts from multiple security platforms, identifying potential security incidents, and escalating confirmed threats to higher support tiers for further investigation and response. The role is responsible for maintaining accurate incident records, documenting findings, and ensuring timely communication and coordination throughout the incident management lifecycle.
• As the SOC operates on a 24x7 basis, this position requires availability to work in rotational shifts to provide continuous monitoring, rapid response, and uninterrupted security coverage for the organization's technology environment.

SLA, Escalation Response Governance

• Govern adherence to defined alert handling SLAs (acknowledgement, triage, escalation, and containment).
• Ensure mandatory escalation paths are followed for high and critical alerts.
• Monitor SLA breaches, identify root causes, and drive corrective and preventive actions.

Alert-to-Incident Conversion Governance

• Define and enforce criteria for converting alerts into incidents.
• Ensure correlated alerts are grouped into single incidents to reflect true attack scenarios.
• Validate incident severity, scope, and impact prior to escalation to Incident Response teams.

Metrics, Reporting Continuous Improvement

• Define and monitor SOC alert handling KPIs, including MTTA / MTTR, false positive rate, alert backlog, incident conversion ratio.
• Conduct regular alert quality reviews and highlight areas for process improvement.
• Translate lessons learned from alerts and incidents into process, playbook, and detection enhancements.

Additional Accountabilities pertaining to the role

• Own and continuously improve Incident Response Governance, including policies, playbooks, runbooks, and escalation matrices.
• Design and update incident response playbooks for cloud, identity, endpoint, email, data, and thirdparty incidents.
• Drive SOC maturity improvements by identifying process gaps and optimizing response workflows.
• Risk analysis and mitigation
• Vendor Co-ordination
• Strong troubleshooting, analytical, and communication skills
• Energetic, self-motivated and self-sufficient in accomplishing tasks.
• Good analytical and problem solving skills.

Key Decisions / Dimensions

• Identification of right contacts to channelise the issue/problem for closure.
• Review the alert/incident and categorised True positive / False positive and take required steps.
• Discuss observation response as applicable to improve security controls.
• Decide if the policy and procedure documents need changes based on new regulations or audit outcomes; potential regulatory actions due to non-compliances.

Major Challenges

• Handling of fast changing environment with variety of cloud service providers.
• Handling of compliance expectations in stringent timelines.
• Handling multiple stakeholders at a time.
• Coordination with third party consultants who assist in auditing and compliance initiatives.

Required Qualifications and Experience

a) Qualifications

Minimum 3+ years of experience in handling team (lead) in Security operations center.

• Strong hands-on experience on Microsoft Sentinel incident handling including Azure IAM, Key vault, WAF, EDR, CSPM CWP.
• Strong knowledge experience on alert correlation aspect.
• Sensible on organization risk, IT risk impact analysis.
• Experience in Project management.
• Positive attitude, Hard Worker and team player
• Certifications like CEH (Ethical Hacking), Azure/AWS Security, ISO 27001 is mandatory