Department Manager

You will own the end-to-end incident response lifecycle at CP Axtra — from detection and triage through containment, eradication, and recovery, all the way to post-incident review and capability improvement. You are the Incident Commander during major security events, the person in the war room making real-time decisions about containment actions, stakeholder communications, and escalation paths.

Beyond crisis response, you'll build and mature the incident response programme itself. This means developing playbooks tailored to CP Axtra's specific threat scenarios (ransomware hitting POS systems, credential stuffing on the e-commerce login, insider threats in finance systems), running realistic tabletop exercises, and driving post-incident reviews that produce actual operational improvements — not just reports that gather dust.

You'll manage the SOC team's operational effectiveness, own the KPIs that matter (MTTD, MTTR, false positive rates), and work closely with the Security Architect and GRC teams to ensure lessons learned feed back into both technical controls and governance processes.

Key Responsibilities:

·       Serve as Incident Commander for all Severity-1 and Severity-2 security incidents — lead war rooms, make containment decisions, coordinate cross-functional response, and manage executive communications

·       Build and maintain the incident response playbook library — at least 15 scenario-specific playbooks covering ransomware, data exfiltration, credential compromise, DDoS, insider threat, cloud breach, and supply chain compromise

·       Drive post-incident reviews (PIRs) for every significant incident, producing root cause analyses with specific, tracked remediation actions — not generic recommendations

·       Own and improve SOC operational KPIs: MTTD < 30 minutes, MTTR < 4 hours for critical incidents, false positive rate < 20% on high-priority alerts

·       Design and execute quarterly tabletop exercises and annual red team/purple team engagements, measuring response effectiveness and identifying capability gaps

·       Manage relationships with MSSP/MDR providers — review SLAs, escalation performance, and detection quality monthly; hold them accountable to contractual commitments

·       Develop and maintain the incident communication framework — pre-drafted templates for executive briefings, customer notifications, regulatory reports (PDPA breach notification), and media holding statements

·       Coordinate with legal, compliance, and communications teams during incidents that have regulatory, legal, or public-relations implications

·       Maintain the threat intelligence integration pipeline — ensure IOCs and TTPs from threat feeds are operationalised into detection rules within 24 hours