SOC-IR - Assistant Manager

Role & responsibilities

• 3-7 years in Incident Response (IR) Analyst is responsible for identifying, investigating, containing, eradicating, and recovering from cybersecurity incidents affecting the Bank's information assets. The role also includes proactive monitoring of Deep Web and Dark Web sources to identify compromised credentials, payment card data, customer information, and other sensitive information related to the Bank, enabling timely risk mitigation and response.
• Monitor and investigate security incidents reported by SOC, threat intelligence platforms, fraud teams, CERT-In, and external agencies.
• Perform incident triage, analysis, containment, eradication, and recovery activities.
• Coordinate with internal stakeholders and technology teams during incident response.
• Conduct forensic evidence collection while maintaining chain of custody.
• Document incidents, root cause analysis, lessons learned, and corrective actions.
• Support post-incident reviews and continuous improvement initiatives.

Continuously monitor Deep Web and Dark Web sources for:

• Employee credentials
• Privileged account credentials
• Customer credentials
• Internet Banking credentials
• Corporate Banking credentials
• VPN and remote access credentials
• Administrative account credentials
• Payment card (credit/debit) information
• BIN-related fraud intelligence
• SWIFT-related intelligence
• ATM/POS compromise indicators
• Customer Personally Identifiable Information (PII)
• Bank domain impersonation
• Phishing kits
• Malware targeting the Bank
• Data leak announcements
• Ransomware victim listings
• Validate discovered information to reduce false positives.
• Assess the business impact and initiate incident response activities where required.
• Coordinate immediate password resets, account monitoring, card blocking, fraud monitoring, and customer notifications when applicable.
• Produce actionable intelligence reports and recommend mitigation measures.