Manager SOC Incident

SBI Card; Bengaluru; On-site; INR 1,500,000 - 2,100,000; Full time

Job summary

SBI Card seeks a proficient SOC Incident Analyst to monitor security events, investigate alerts, and respond to cyber security incidents. You will triage alerts, correlate logs, and coordinate remediation with IT and security teams to strengthen the organization’s cyber defense posture.

The role emphasizes maintaining incident records, supporting playbooks, and ongoing improvements to detection and response capabilities within a BFSI context.

Qualifications

• Bachelor’s degree / B.E. / B.Tech / BCA / B.Sc. / MCA in Computer Science, Information Technology, Cyber Security, Information Systems or related discipline.

Responsibilities

• Monitor security alerts from SIEM, EDR/XDR, email security, web security, identity, cloud and other monitoring platforms.
• Perform initial triage of alerts to determine severity, validity, affected assets, user context and potential business impact.
• Investigate incidents by correlating logs, telemetry, threat intelligence and security events to determine scope, root cause and impact.
• Identify indicators of compromise, suspicious behaviors, policy violations and potential attack patterns during investigations.
• Escalate high-severity incidents to SOC leads or incident response teams with clear evidence, impact assessment and containment recommendations.
• Execute approved response playbooks under supervision, including IOC blocking, account disablement, endpoint isolation and access reset actions.
• Coordinate with IT, infrastructure, application and identity teams for remediation actions such as patching, configuration changes and access corrections.
• Maintain shift handover notes and investigation continuity to ensure open cases are tracked and acted upon without delay.
• Document incidents with timelines, evidence, affected systems, actions taken, escalation details and closure notes for audit and post-incident reviews.
• Support alert tuning by providing feedback on false positives, missed detections, recurring alerts and monitoring gaps.
• Participate in tabletop exercises, purple-team drills and SOC process improvement activities to strengthen response readiness.
• Maintain awareness of emerging threats, attack techniques and SOC procedures to improve triage quality and investigation effectiveness.

Skills

Incident Response

Investigation & Crisis Handling

AI Security Testing

Threat Monitoring

Detection Engineering

SOC Monitoring

Education

Bachelor's degree / B.E. / B.Tech / BCA / B.Sc. / MCA in Computer Science or Cyber Security

Tools

Microsoft Sentinel

Splunk

QRadar

CrowdStrike Falcon

Email security consoles

Web security consoles

ServiceNow SecOps

KQL / SPL

IOC analysis

Incident playbooks

CASB

Job description

Role Purpose

The SOC Incident Analyst will monitor security events, investigate alerts and respond to cyber security incidents affecting the organization. The role is accountable for identifying threats, conducting analysis and supporting remediation activities to reduce cyber risk. The role will contribute to maintaining a robust security monitoring capability and improving the organization’s cyber defense posture.

Role Accountability

• Monitor security alerts from SIEM, EDR/XDR, email security, web security, identity, cloud and other monitoring platforms.
• Perform initial triage of alerts to determine severity, validity, affected assets, user context and potential business impact.
• Investigate incidents by correlating logs, telemetry, threat intelligence and security events to determine scope, root cause and impact.
• Identify indicators of compromise, suspicious behaviors, policy violations and potential attack patterns during investigations.
• Escalate high-severity incidents to SOC leads or incident response teams with clear evidence, impact assessment and containment recommendations.
• Execute approved response playbooks under supervision, including IOC blocking, account disablement, endpoint isolation and access reset actions.
• Coordinate with IT, infrastructure, application and identity teams for remediation actions such as patching, configuration changes and access corrections.
• Maintain shift handover notes and investigation continuity to ensure open cases are tracked and acted upon without delay.
• Document incidents with timelines, evidence, affected systems, actions taken, escalation details and closure notes for audit and post-incident reviews.
• Support alert tuning by providing feedback on false positives, missed detections, recurring alerts and monitoring gaps.
• Participate in tabletop exercises, purple-team drills and SOC process improvement activities to strengthen response readiness.
• Maintain awareness of emerging threats, attack techniques and SOC procedures to improve triage quality and investigation effectiveness.

Measures of Success

• Security alerts are triaged accurately within defined timelines.
• Incidents are investigated with clear evidence, impact assessment and escalation notes.
• High-severity cases are escalated promptly with actionable containment recommendations.
• Approved response playbooks are followed consistently during containment and remediation.
• Incident records include complete timelines, artefacts, actions and closure details.
• Shift handovers maintain continuity of open investigations.
• Feedback from investigations helps reduce false positives and improve detection quality.

Technical Skills

• Incident Response, Investigation & Crisis Handling
• AI Security Testing, Threat Monitoring & Abuse Detection
• Detection Engineering, Telemetry, SIEM/XDR Data & Use-Case Lifecycle Management
• SOC Monitoring & Alert Triage & Incident Operations
• Security Platform Operations, DLP & Automation
• Threat, Vulnerability & Exposure Management

Exposure to below mentioned Technologies / Frameworks / Methodologies

• Microsoft Sentinel
• Splunk
• QRadar
• CrowdStrike Falcon
• Email security consoles
• Web security consoles
• ServiceNow SecOps
• KQL / SPL
• IOC analysis
• Incident playbooks
• CASB

Qualification

Bachelor’s degree / B.E. / B.Tech / BCA / B.Sc. / MCA in Computer Science, Information Technology, Cyber Security, Information Systems or related discipline.

Preferred Industry

BFSI, payments, banking, fintech, large enterprises with SIEM / EDR monitoring, alert triage, incident handling and security operations exposure.