Head - Operations - State Computer Security Incident Response Team

Designation - Head Operations - State CSIRT

Department - State Computer Security Incident Response Team, Department of Science & Technology, Government of Madhya Pradesh

Place of Work Bhopal

Job Type:

Contractual upto 5 years (based on yearly performance review) through Third Party Agency

Education & Experience:

Essential Criteria/ Qualification: Engineering Graduate in any discipline. And Post-graduate In Forensics (preferably in Cyber Forensics).

Certifications : Must have Certified Information Systems Security Professional (CISSP) OR Certified Information Security Manager (CISM) And (Any certification mentioned below from a recognized institute): - Certified in Risk and Information Systems Control (CRISC) / Certified Incident Handler (GCIH) / Certified Intrusion Analyst (GCIA) / Certified Ethical Hacker (CEH) / Certified Computer Security Incident Handler (CSIH) / Certified Information Privacy Professional (CIPP) / CompTIA Security+ / Offensive Security Certified Professional (OSCP) / Certified SoC Analyst / Equivalent.

Work Experience:

1. Minimum 15-year work experience leading team in the field of cybersecurity along with techno-functional hands-on experience in end to end Cyber Security Incident Management & Forensics.

2. Must be well-versed in crafting strategy, policy and plan related to Cyber Security Implementation.

3. The experience must include conducting incident investigations, cyber forensics and recovery from ransomware.

Job Objective :

1. Primarily responsible for end-to-end operations of State CSIRT.

2. To provide a focused management and delivery approach across relevant areas of State CSIRT.

3. Ensuring that proper operational procedures and practices are in placeand are being enforced effectively for timely resolution of cyber security incidents reported to and tracked.

4. The incumbent will be responsible for assisting of incidents, identification, containment, eradication and post incident follow-up actions while also protecting the government's information systems and data along with swift restoration of normal operations.

5. Responsible for performing risk assessments, coordinating with respective teams during a security breach, and using various cybersecurity tools and technologies.

Primary Responsibilities:

1. To prepare Strategy, Policy and Procedure Enforcement: Ensure that the state's incident response policies and procedures are adhered to and that they remain effective and up-to-date.

2. Review, facilitate & approve state's overall cybersecurity strategy, policies & plan in-line with the industry standards to protect information Technology Systems.

3. The candidate should coordinate with various stakeholders, such as IT teams, security professionals, management, and external parties (vendors, law enforcement, etc.), to ensure a coordinated and effective response to security incidents. He is also to engage with other CSIRTs and industry organizations for information sharing and collaborative incident response.

4. The candidate should track and analyze relevant metrics to measure the CSIRT's performance and effectiveness. They generate reports on incident trends, response times, resolution rates, and other key performance indicators (KPIs) to assess the team's overall performance and support decision-making processes.

5. The incumbent will lead the team even during crisis management & emergency response. S(he) will also be responsible for conducting incident investigations, and recovery from ransomware as and when
required.

6. Identification & support in implementation of tools/techniques for automation of incident analysis & response, threat intelligence platforms and forensic tools.

7. Perform & Assist in detailed investigations and forensic analysis to understand the nature of the security incident, identify how the breach occurred, who was responsible, and what can be done to prevent similar incidents in the future.

8. Review & Approve the incident/malware analysis reports and suggesting appropriate resolution measures.

9. Ensuring that third-party service providers are adhering to the organization's security standards and policies w.r.t to SLA.

10. Threat Intelligence: Use threat intelligence tools and methodologies to anticipate potential threats and stay updated on the latest cybersecurity threats and attack trends.

11. The incumbent would promote the professional growth and development of State CSIRT team members while identifying training needs, provide mentoring and coaching, organize workshops or exercises, and encourage continuous learning to enhance the team's technical skills, incident response capabilities, and overall expertise.

12. Keeping abreast of the latest cybersecurity trends and innovations, and implementing new technologies to enhance the security infrastructure of the organization.

13. Plan & ensure the execution of Cyber Security Incident Drills and Simulations to assess the readiness of the organization's incident response team and improve their skills.

14. Any other responsibilities assigned by the Director/ Joint Director, SCSRIT.