Lead SOC - Splunk ES

Rapsys Technologies Pte Ltd.; Bengaluru Urban; Remote; INR 3,500,000 - 8,000,000; Full time

Job summary

Rapsys Technologies Pte Ltd. seeks a Lead SOC - Splunk ES to own offshore SOC operations with a focus on governance, detection quality, and automation.

You will drive day-to-day performance while enhancing AI-assisted features across the security stack without compromising analyst judgment or traceability. The role requires hands-on Splunk ES experience, strong leadership, and the ability to coordinate with offshore teams serving U.S.-based stakeholders.

Qualifications

• Minimum 6 years of experience in cybersecurity/SOC roles.
• Strong security operations leadership experience, including direct management in 24x7 or follow-the-sun models.
• Advanced proficiency in Splunk-based SOC operations and knowledge of endpoint, network, email, and vulnerability telemetry.
• Ability to coach analysts, review investigations, and enforce consistent case quality and rigor.
• Strong executive-facing communication and governance driving with metrics and remediation actions.
• Experience working with offshore teams serving U.S.-based stakeholders.

Responsibilities

• Lead offshore SOC pod across L1/L2, ensure queue health, review investigations, and align with security leadership.
• Own daily operational governance: case quality, severity calibration, shift handoffs, SLA adherence, escalation discipline.
• Drive continuous improvement in Splunk ES / Mission Control operations, alert tuning, and visibility gap identification.
• Coordinate with CrowdStrike, Proofpoint, Qualys, Palo Alto, Dragos, ServiceNow, and automation to boost response effectiveness.
• Translate technical events into concise business risk language for U.S. stakeholders and support weekly reviews and KPI reporting.
• Promote responsible use of AI-assisted tooling within approved guardrails and automation.

Skills

SOC leadership

Splunk ES

Executive communication

Offshore collaboration

Incident governance

Tools

Splunk ES

Mission Control

CrowdStrike

Proofpoint

Qualys

Palo Alto

Dragos

ServiceNow

Microsoft Teams

M365/Entra

Job description

We're Hiring: Lead SOC - Splunk ES!

The client has re-emphasized that they need candidates with recent hands-on Splunk experience and have been active user of Splunk, integration and automation

Lead offshore SOC execution combining operational leadership, detection governance, case quality oversight, and practical automation. This role must drive disciplined day-to-day performance while improving the use of built-in AI / automation features across the CLW security stack without sacrificing analyst judgement, traceability, or investigation fidelity.

Location: Bangalore Urban, India
Work Mode: Work from anywhere
Role: Lead SOC - Splunk ES

What You'll Do:

• Lead the offshore SOC pod acrossL1 and L2 activities, ensure queue health, review investigation quality, andmaintain strong stakeholder alignment with Clearwater Paper securityleadership.
• Own daily operational governanceincluding case quality, severity calibration, shift handoffs, SLA adherence,and escalation discipline for major incidents.
• Drive continuous improvement inSplunk ES / Mission Control operations, detection logic review, alert noisereduction, and visibility gap identification.
• Coordinate across CrowdStrike,Proofpoint, Qualys, Palo Alto, Dragos, ServiceNow, and automation workflows to improve response effectiveness.
• Translate technical events intoconcise business risk language for U.S. stakeholders and support weekly servicereviews, KPI reporting, and corrective action tracking.
• Promote responsible use ofAI-assisted summarization, enrichment, and workflow acceleration withinapproved guardrails. Tool Environment Splunk ES / Mission Control, CrowdStrike,Qualys, Proofpoint, Palo Alto, Dragos, ServiceNow, Teams, M365 / Entra context,automation / SOAR capabilities where approved.

What We're Looking For:

• Minimum 6 years of experience in cybersecurity/SOC roles
• Strong security operationsleadership experience, including direct management of analysts or providerteams in a 24x7 or follow-the-sun model.
• Advanced proficiency inSplunk-based SOC operations and solid working knowledge of endpoint, network,email, and vulnerability telemetry.
• Ability to coach analysts,review investigations, and enforce consistent case quality and operationalrigor.
• Strong executive-facingcommunication and ability to run governance reviews with facts, metrics, andremediation actions.
• Experience working with offshore teams servingU.S.-based stakeholders