Security Product Architect

VOLKSWAGEN GROUP DIGITAL SOLUTIONS PRIVATE LIMITED; Pune District, Gurugram District, Bengaluru; On-site; INR 3,500,000 - 5,500,000; Full time

Job summary

VOLKSWAGEN GROUP DIGITAL SOLUTIONS PRIVATE LIMITED is seeking an L3 Security Specialist / Incident Response Lead to act as the highest technical escalation point in a 24x7 CERT service model. You will guide complex investigations, advise on containment, and mentor junior teams while driving runbook and detection improvements.

Mandatory expertise includes incident response, SIEM/SOAR workflows, and communication of technical risk to stakeholders.

Qualifications

• Bachelor's degree in cybersecurity, computer science, information security, or related field.
• Typically 6–10+ years of incident response or senior security operations experience.
• Certifications such as GCIA, GCIH, GCFA, CISSP, SC-200 or equivalent are advantageous.

Responsibilities

• Lead technical investigations of complex, high-severity incidents beyond standard analysis.
• Perform advanced scoping to determine extent of compromise and attack progression.
• Provide containment recommendations based on risk and business impact.
• Translate technical findings into executive summaries for stakeholders.
• Mentor L1/L2 teams and drive improvements in detections and playbooks.

Skills

Incident response

Threat investigation

SIEM/SOAR platforms

Education

Bachelor's degree in Cybersecurity / CS / Information Security

Job description

Job Summary

The L3 Security Specialist / Incident Response Lead acts as the highest technical escalation point for critical complex security incidents in the 24x7 CERT service model. This role is responsible for advanced threat investigation, technical leadership during severe incidents, scoping of impact, specialist analysis, strategic containment advice, improvement of runbooks/detections, support to service governance for major security risks. The role also acts as a technical mentor for L1/L2 teams helps strengthen operational maturity over time.

Key Responsibilities

• Lead Technical Investigation of Complex, High-Severity, or Escalated Security Incidents Beyond Standard L2 Analysis
• Perform Advanced Incident Scoping to Determine Extent of Compromise, Impacted Systems/Accounts, Attack Sequence, Likely Threat Progression
• Review Escalations Involving Suspicious Privileged Activity, Repeated Compromise Patterns, Container/Runtime Anomalies, High-Risk Infrastructure Alerts, or Evidence of Coordinated Attack Behavior
• Provide Expert-Level Containment Remediation Recommendations Based on Risk, Business Criticality, Threat Behavior, Operational Constraints
• Support High-Priority Incident Communications by Translating Technical Findings into Structured Stakeholder-Ready Updates
• Work Closely with Internal Resolver Groups, Infrastructure/Application Owners, Incident Managers, Service Management Stakeholders During Critical Investigations
• Identify Systemic Weaknesses Recurring Root Causes, Recommend Longer-Term Improvements in Detection Use Cases, Process Maturity, SOPs, Playbooks, Escalation Models
• Guide Security Analysts on Advanced Analysis Methods, Evidence Handling, Incident Scoping, Response Decision-Making
• Participate in Weekly Incident Reviews, Monthly Governance Reporting, Continuous Service Improvement Discussions with a Strong Focus on Risk Trends Service Resilience
• Strengthen Knowledge Management Through Development of Advanced Use Cases, Threat Investigation Patterns, Specialized Runbooks, Lessons Learned Documentation

Required Technical Skills

• Deep Expertise in Incident Response, Advanced Threat Investigation, Attack Analysis, Containment Strategy, Operational Decision-Making in Live Incidents
• Strong Experience with SIEM/SOAR Platforms, Especially Investigation Workflows, Offense Analysis, Data Correlation, High-Fidelity Case Handling
• Strong Understanding of Security Telemetry Across Logs, Authentication Systems, Network Activity, Endpoint Behavior, Container/Runtime Monitoring, Threat Advisories
• Ability to Assess Business Impact vs Technical Severity Advise on Containment Actions Without Losing Sight of Continuity Requirements
• Strong Knowledge of Incident Lifecycle Management, Escalation Governance, Reporting, Knowledge Management, Service Improvement Practices
• Ability to Write Clear Executive Technical Summaries for Senior Stakeholders Operational Teams

Required Experience / Qualification

• Bachelors Degree in Cybersecurity, Computer Science, Information Security, or Related Field Preferred
• Typically 610+ Years of Experience in Incident Response, CERT/SOC Engineering, Advanced Threat Analysis, or Senior Security Operations Roles
• Proven Experience Handling Critical/High-Severity Security Investigations Guiding Cross-Functional Technical Response
• Certifications such as GCIA, GCIH, GCFA, CISSP, SC-200, Vendor SIEM Certifications, or Equivalent Advanced Credentials would be Advantageous