You will own the end-to-end incident response lifecycle at CP Axtra — from detection and triage through containment, eradication, and recovery, all the way to post-incident review and capability improvement. You are the Incident Commander during major security events, the person in the war room making real-time decisions about containment actions, stakeholder communications, and escalation paths.

Beyond crisis response, you'll build and mature the incident response programme itself. This means developing playbooks tailored to CP Axtra's specific threat scenarios (ransomware hitting POS systems, credential stuffing on the e-commerce login, insider threats in finance systems), running realistic tabletop exercises, and driving post-incident reviews that produce actual operational improvements — not just reports that gather dust.

You'll manage the SOC team's operational effectiveness, own the KPIs that matter (MTTD, MTTR, false positive rates), and work closely with the Security Architect and GRC teams to ensure lessons learned feed back into both technical controls and governance processes.

Key Responsibilities

• Serve as Incident Commander for all Severity-1 and Severity-2 security incidents — lead war rooms, make containment decisions, coordinate cross-functional response, and manage executive communications
• Build and maintain the incident response playbook library — at least 15 scenario-specific playbooks covering ransomware, data exfiltration, credential compromise, DDoS, insider threat, cloud breach, and supply chain compromise
• Drive post-incident reviews (PIRs) for every significant incident, producing root cause analyses with specific, tracked remediation actions — not generic recommendations
• Own and improve SOC operational KPIs: MTTD < 30 minutes, MTTR < 4 hours for critical incidents, false positive rate < 20% on high-priority alerts
• Design and execute quarterly tabletop exercises and annual red team/purple team engagements, measuring response effectiveness and identifying capability gaps
• Manage relationships with MSSP/MDR providers — review SLAs, escalation performance, and detection quality monthly; hold them accountable to contractual commitments
• Develop and maintain the incident communication framework — pre-drafted templates for executive briefings, customer notifications, regulatory reports (PDPA breach notification), and media holding statements
• Coordinate with legal, compliance, and communications teams during incidents that have regulatory, legal, or public-relations implications
• Maintain the threat intelligence integration pipeline — ensure IOCs and TTPs from threat feeds are operationalised into detection rules within 24 hours
• Build incident response capabilities in the SOC team through structured skill development, scenario-based training, and mentoring

Requirements

• EDR/XDR: Cortex XDR, CrowdStrike Falcon — investigation, threat hunting, and response actions
• SIEM/SOAR: Splunk, Microsoft Sentinel, or equivalent — log analysis, correlation rules, automated playbooks
• Forensics: Disk and memory forensics tools, network packet analysis — enough to guide investigations and validate findings
• Threat intelligence: MISP, commercial threat feeds — IOC management and operationalisation
• Cloud investigation: GCP, Azure, AWS — cloud-native logging (CloudTrail, Activity Log, Audit Log) and investigation procedures
• Network security: Palo Alto, Fortinet — log analysis, firewall containment actions during incidents

MUST-HAVE REQUIREMENTS

These are non-negotiable. If you do not meet all of these, this role is not the right fit.

• 5+ years in cyber security with at least 2 years leading incident response or SOC operations
• Demonstrated experience as Incident Commander during real security incidents — you've made containment decisions under pressure, not just participated in tabletops
• Strong knowledge of attack frameworks (MITRE ATT&CK, Cyber Kill Chain) and ability to map real incidents to TTPs for detection improvement
• Experience with EDR/XDR platforms (Cortex XDR, CrowdStrike, or equivalent) and SIEM — you can investigate alongside your analysts, not just manage from a dashboard
• Excellent communication skills — ability to translate technical incident details into business impact language for executives and non-technical stakeholders
• Fluent in Thai; working English proficiency for vendor coordination and threat intelligence consumption

NICE-TO-HAVE

These will set you apart from other candidates:

• GCIH, GCFA, GCIA, or equivalent incident response / forensics certifications
• Experience managing MSSP/MDR relationships and holding third-party SOCs accountable to SLAs
• Familiarity with Thai regulatory incident reporting requirements (PDPA breach notification timelines, sector-specific reporting)
• Experience with incident response in retail or e-commerce environments — POS malware, card skimming, credential stuffing at scale
• Purple team experience — working with offensive security teams to validate detection and response capabilities