Security Incident Response

Job Summary

We are seeking an experienced Security Incident Response Manager to lead our organizations ability to detect respond to contain and recover from cybersecurity incidents

The role focuses on safeguarding card and payment ecosystems through robust identity management advanced endpoint defense security analytics and incident response practices while enabling a secure hybrid work model.

Responsibilities

Incident Response Leadership

Serve as the Incident Commander for major security incidents coordinating technical responders leadership legal PR and business stakeholders

Own and continuously mature the organizations Incident Response Plan IRP playbooks and runbooks across threat categories ransomware data breach insider threat DDoS business email compromise supply chain compromise etc

Team Program Management

Build mentor and manage a team of incident responders andor coordinate a virtual crossfunctional IR team SOC IT legal HR comms

Define and track IR KPIsmetrics MTTD MTTR containment time recurrence rate and report trends to the CISO and executive leadership

Run regular tabletop exercises purple team simulations and IR drills to test organizational readiness

Threat Detection Forensics

Partner with the SOCThreat Detection team to refine detection use cases alert triage workflows and escalation criteria

Oversee digital forensics and root cause analysis RCA efforts ensuring proper chainofcustody and evidence handling

Required Qualifications

6 years of experience in cybersecurity with at least 3 years directly in incident response SOC leadership or digital forensics

Proven experience leading response efforts for significant security incidents breach ransomware insider threat etc

Strong working knowledge of incident response frameworks NIST 80061 SANS MITRE ATTCK

Handson experience with SIEM Splunk EDRXDR Defender SOAR platforms and forensic tools EnCase FTK Volatility etc

Solid understanding of networking endpoint cloud AWSAzureGCP and identity security concepts

Experience managing or mentoring a team or coordinating crossfunctional virtual teams during highpressure events

Excellent written and verbal communication skills able to translate technical detail into businessrelevant risk narratives for executives and boards

• Collaborate with security operations teams to enhance SOC and SIEM monitoring coverage by defining tuning and validating alerts that focus on high value cardholder data assets and critical transaction flows.
• Conduct forensic investigations using FTK and EnCase to identify root causes of security incidents within card and payment systems and to support evidence driven containment and recovery actions.
• Define endpoint security strategies using Microsoft Defender for Endpoint to protect workstations servers and payment processing endpoints from malware ransomware and advanced persistent threats.
• Partner with networking teams to design secure network topologies for data centers branches and cloud environments that apply strong segmentation encryption and traffic inspection controls for payment data paths.
• Coordinate with incident management stakeholders to ensure escalation paths communication plans and post incident reviews consistently reduce response times and improve resilience of payment services.
• Create and maintain technical documentation including architecture diagrams playbooks standards and best practices that guide teams in operating and evolving security capabilities for card and payment platforms.
• Engage with product and engineering teams to embed security requirements into the software delivery lifecycle ensuring that new features for cards and payments are designed tested and deployed with strong preventive and detective controls.
• Provide mentorship and knowledge sharing to peers and junior security professionals by conducting workshops tabletop exercises and training sessions focused on cloud security identity security and incident handling for payment systems.

Qualifications

• possess eight to ten years of progressive experience in cyber security architecture with substantial exposure to large scale enterprise or financial services environments that operate card and payment platforms.
• demonstrate deep hands on expertise with Microsoft Identity Manager including design deployment and integration with cloud identity services and enterprise directories that support secure access to critical systems.
• show strong proficiency in securing AWS GCP and Azure cloud environments covering identity and access management network controls logging encryption key management and integration with central SIEM platforms.
• exhibit robust knowledge of networking concepts including routing switching firewalls load balancing VPNs DNS and secure connectivity patterns that support resilient payment processing infrastructures.
• display practical experience using FTK and EnCase for digital forensics covering evidence acquisition timeline analysis artifact review and report creation that supports incident response and compliance needs.
• apply advanced skills with ServiceNow SOAR for building playbooks connectors and automated workflows that orchestrate enrichment response and collaboration activities across SOC teams.
• leverage Microsoft Defender for Endpoint to design policies detections and response strategies that address threats targeting user devices servers and specialized payment endpoints.
• utilize Splunk SIEM to build dashboards correlation searches threat detection rules and reports that support continuous monitoring of cardholder data environments and cloud workloads.
• apply Mitre ATTandCK framework knowledge to map adversary behaviors identify control gaps and prioritize detections that align with realistic threats to payment ecosystems.
• bring solid experience working in SOC and SIEM driven operations including tuning alerts improving runbooks collaborating with analysts and enhancing coverage for high risk systems.
• demonstrate strong incident management capabilities including triage investigation containment eradication recovery and post incident reviews with emphasis on minimizing customer impact.
• present proven domain experience in cards and payments including understanding of transaction flows authorization clearing settlement cardholder data protection and relevant regulatory expectations.
• communicate effectively with technical and nontechnical stakeholders through clear documentation presentations and discussions that support informed decision making on security architecture tradeoffs.

关于高知特 (Cognizant)
高知特(Cognizant)（纳斯达克代码：CTSH）作为一家AI Builder和相关技术服务提供商，致力于通过打造全栈AI解决方案，帮助企业将人工智能投资转化为实际价值。公司凭借深厚的行业经验、流程优化和工程技术专长，将企业独特的业务场景融入科技系统，赋能组织释放人才潜能，推动切实成果，并帮助全球企业在瞬息万变的环境中保持领先。如需了解更多详情，敬请访问 cognizant.ai 或关注@cognizant。

补充雇佣信息
薪酬信息截至本职位发布之日为准。Cognizant 保留在适用法律允许的范围内随时修改该信息的权利。
申请人可能需要通过现场面试或视频会议的方式参加面试。此外，候选人在每次面试时可能需要出示其当前所在州或政府签发的有效身份证件。
Cognizant 是一家提供平等就业机会的雇主。在招聘过程中，您的申请和候选资格不会因种族、肤色、性别、宗教、信仰、性取向、性别认同、国籍、残疾、遗传信息、怀孕、退伍军人身份或任何其他受联邦、州或地方法律保护的特征而受到影响。