Security Incident Response

Job Summary

We are seeking an experienced Security Incident Response Manager to lead our organizations ability to detect respond to contain and recover from cybersecurity incidents

The role focuses on safeguarding card and payment ecosystems through robust identity management advanced endpoint defense security analytics and incident response practices while enabling a secure hybrid work model.

Responsibilities

Incident Response Leadership

Serve as the Incident Commander for major security incidents coordinating technical responders leadership legal PR and business stakeholders

Own and continuously mature the organizations Incident Response Plan IRP playbooks and runbooks across threat categories ransomware data breach insider threat DDoS business email compromise supply chain compromise etc

Team Program Management

Build mentor and manage a team of incident responders andor coordinate a virtual crossfunctional IR team SOC IT legal HR comms

Define and track IR KPIsmetrics MTTD MTTR containment time recurrence rate and report trends to the CISO and executive leadership

Run regular tabletop exercises purple team simulations and IR drills to test organizational readiness

Threat Detection Forensics

Partner with the SOCThreat Detection team to refine detection use cases alert triage workflows and escalation criteria

Oversee digital forensics and root cause analysis RCA efforts ensuring proper chainofcustody and evidence handling

Required Qualifications

6 years of experience in cybersecurity with at least 3 years directly in incident response SOC leadership or digital forensics

Proven experience leading response efforts for significant security incidents breach ransomware insider threat etc

Strong working knowledge of incident response frameworks NIST 80061 SANS MITRE ATTCK

Handson experience with SIEM Splunk EDRXDR Defender SOAR platforms and forensic tools EnCase FTK Volatility etc

Solid understanding of networking endpoint cloud AWSAzureGCP and identity security concepts

Experience managing or mentoring a team or coordinating crossfunctional virtual teams during highpressure events

Excellent written and verbal communication skills able to translate technical detail into businessrelevant risk narratives for executives and boards

• Collaborate with security operations teams to enhance SOC and SIEM monitoring coverage by defining tuning and validating alerts that focus on high value cardholder data assets and critical transaction flows.
• Conduct forensic investigations using FTK and EnCase to identify root causes of security incidents within card and payment systems and to support evidence driven containment and recovery actions.
• Define endpoint security strategies using Microsoft Defender for Endpoint to protect workstations servers and payment processing endpoints from malware ransomware and advanced persistent threats.
• Partner with networking teams to design secure network topologies for data centers branches and cloud environments that apply strong segmentation encryption and traffic inspection controls for payment data paths.
• Coordinate with incident management stakeholders to ensure escalation paths communication plans and post incident reviews consistently reduce response times and improve resilience of payment services.
• Create and maintain technical documentation including architecture diagrams playbooks standards and best practices that guide teams in operating and evolving security capabilities for card and payment platforms.
• Engage with product and engineering teams to embed security requirements into the software delivery lifecycle ensuring that new features for cards and payments are designed tested and deployed with strong preventive and detective controls.
• Provide mentorship and knowledge sharing to peers and junior security professionals by conducting workshops tabletop exercises and training sessions focused on cloud security identity security and incident handling for payment systems.

Qualifications

• possess eight to ten years of progressive experience in cyber security architecture with substantial exposure to large scale enterprise or financial services environments that operate card and payment platforms.
• demonstrate deep hands on expertise with Microsoft Identity Manager including design deployment and integration with cloud identity services and enterprise directories that support secure access to critical systems.
• show strong proficiency in securing AWS GCP and Azure cloud environments covering identity and access management network controls logging encryption key management and integration with central SIEM platforms.
• exhibit robust knowledge of networking concepts including routing switching firewalls load balancing VPNs DNS and secure connectivity patterns that support resilient payment processing infrastructures.
• display practical experience using FTK and EnCase for digital forensics covering evidence acquisition timeline analysis artifact review and report creation that supports incident response and compliance needs.
• apply advanced skills with ServiceNow SOAR for building playbooks connectors and automated workflows that orchestrate enrichment response and collaboration activities across SOC teams.
• leverage Microsoft Defender for Endpoint to design policies detections and response strategies that address threats targeting user devices servers and specialized payment endpoints.
• utilize Splunk SIEM to build dashboards correlation searches threat detection rules and reports that support continuous monitoring of cardholder data environments and cloud workloads.
• apply Mitre ATTandCK framework knowledge to map adversary behaviors identify control gaps and prioritize detections that align with realistic threats to payment ecosystems.
• bring solid experience working in SOC and SIEM driven operations including tuning alerts improving runbooks collaborating with analysts and enhancing coverage for high risk systems.
• demonstrate strong incident management capabilities including triage investigation containment eradication recovery and post incident reviews with emphasis on minimizing customer impact.
• present proven domain experience in cards and payments including understanding of transaction flows authorization clearing settlement cardholder data protection and relevant regulatory expectations.
• communicate effectively with technical and nontechnical stakeholders through clear documentation presentations and discussions that support informed decision making on security architecture tradeoffs.

About Cognizant: 
Cognizant (Nasdaq: CTSH) is an AI Builder and technology services provider, bridging the gap between AI investment and enterprise value by building full-stack AI solutions for our clients. Our deep industry, process and engineering expertise enables us to build an organization’s unique context into technology systems that amplify human potential, drive tangible outcomes and keep global enterprises ahead in a fast-changing world. See how at cognizant.ai or @cognizant.

Additional employment information
Compensation information is accurate as of the date of this posting. Cognizant reserves the right to modify this information at any time, subject to applicable law.

Applicants may be required to attend interviews in person or by video conference. In addition, candidates may be required to present their current state or government issued ID during each interview.

Cognizant is an equal opportunity employer. Your application and candidacy will not be considered based on race, color, sex, religion, creed, sexual orientation, gender identity, national origin, disability, genetic information, pregnancy, veteran status or any other characteristic protected by federal, state or local laws.