TECHNICAL LEAD - SOC 2

As part of this profile, the resource will perform the following:

Platform Management and Administration

• Administer and manage the NNT Change Tracker FIM, including deployment, configuration, troubleshooting, and ongoing platform optimization.
• Ensure platform health, availability, and secure operation across all POS machines.

Onboarding and offboarding

• Onboarding of POS machines based on the new store opening and PCI-scope countries
• Configuring the FIM rules
• Offboarding of agents based on the store closing request

Troubleshooting and Issue Resolution

• Monitor, identify, and resolve platform-related issues, including:
• Application and console functionality
• Communication with POS machines
• SIEM Integration
• Engage with support processes to address any anomalies that impact tool effectiveness.

Health Monitoring and Availability

• Continuously monitor the status and availability of all assets onboarded to the platform.
• Address failures or downtime to ensure uninterrupted detection coverage.

SOC Integration and Alerting

• Ensure effective integration between Canary and the Security Operations Center (SOC), including:
• Event forwarding to SIEM
• Alert correlation
• Escalation of alerts within SOC processes
• Validate alert quality and reduce false positives through periodic reviews.

Vendor Coordination

• Act as the main point of contact with the NNT Change Track vendor for:
• Technical support
• Issue resolution
• Product updates and enhancements
• Track and manage support tickets and ensure timely closure.

Access Management and Governance

• Manage user accounts and roles for the NNT change tracker management console.
• Conduct quarterly access reviews to validate access rights and enforce the principle of least privilege.

Documentation and SOP Maintenance

• Develop, maintain, and regularly update Standard Operating Procedures (SOPs) for:
• Agent deployment
• Incident response for alerts
• Platform maintenance and upgrade
• Integration workflows

Integration and Security Ecosystem Alignment

• Integrate Canary with other security platforms, such as:
• SIEM
• Threat intelligence systems
• Incident response and ticketing platforms
• Ensure deception data enriches MAF's overall security monitoring and detection framework.

Business Continuity and Disaster Recovery

• Develop, maintain, and periodically test BC/DR plans for the NNT platform and related assets.
• Validate platform recovery capabilities in the event of disruption or attack.
• Incident Sources Covered
• Monitor, integrate, and respond to incidents originating from, the following sources:
• Akamai Web Application Firewall (WAF)
• Extended Detection and Response (XDR) Managed Services (e.g., CrowdStrike)
• Endpoint Detection and Response (EDR) solutions
• Bug Bounty and Vulnerability Disclosure Platforms (e.g., Bugcrowd)
• Security Operations Center (SOC) alerts (from SIEM/SOAR platforms)
• Threat Intelligence Feeds (e.g., Anomali, vendor advisories)
• Internal User and Business Reporting Channels

• Application Performance Monitoring (APM) alerts (e.g., New Relic)

  General Service Requirements

• Demonstrate a thorough understanding of cybersecurity incident management and align with industry best practices.
• Ensure immediate and appropriate response to incidents according to predefined severity levels and Incident Management Processes.
• Investigate incidents thoroughly, document actions taken, and comply with reporting requirements.
• Retain all records and logs related to security incidents and investigations.
• Implement corrective and preventive measures based on the incident's root cause.
• Support incident detection and alerting from Retail-specific APM tools (e.g., New Relic), ensuring coordination between development, application, and security teams.
• Standardize incident handling processes through documented playbooks.
• Coordinate incident resolution actions across IT, application, and infrastructure teams, ensuring closure within agreed SLAs.
• Support internal investigations led by MAF (Majid Al Futtaim) teams as required.
• Review and recommend enhancements to SOC use cases for better detection capabilities.

• Support and manage related ticket types including LSM (Log Source Management), SCM (Security Configuration Management), and Threat Intelligence Tickets.

  Detection & Intake

• Continuously monitor and collect security events from all listed sources.

• Validate and normalize alerts, eliminating false positives to focus on genuine incidents.

  Initial Analysis & Triage

• Confirm the authenticity of reported incidents.
• Determine the nature, origin, and threat actor behaviour.

• Categorize incidents based on their potential impact and urgency.

  Severity Classification

• Assign severity levels (e.g., P1, P2, P3) based on predefined business impact criteria, data sensitivity, and operational risk.
• Ensure P1 incidents are treated as high-priority events requiring immediate containment and escalation.

• Follow the agreed severity classification framework for consistency.

  Incident Containment

• Execute immediate containment actions such as isolating compromised systems, blocking malicious traffic, or disabling compromised accounts.

• Recommend and coordinate appropriate mitigation steps with responsible technical teams.

  Escalation & Coordination

• Initiate a War Room (bridge call) for all P1 incidents to ensure rapid response coordination.
• Engage relevant stakeholders, including BISO (Business Information Security Officer), system owners, and impacted business units.

• Maintain continuous real-time status updates and detailed documentation during the incident lifecycle.

  Remediation Support

• Provide guidance on necessary remediation actions to relevant IT teams.
• Ensure full eradication of Indicators of Compromise (IoCs).

• Coordinate activities such as patching, system hardening, and control implementations where necessary.

  Communication & Updates

• Deliver timely incident status updates to stakeholders.

• Document all incident actions, decisions, and timelines within the incident management and tracking platforms.

  Post-Incident Analysis & RCA

• Conduct Root Cause Analysis (RCA) for all P1 incidents and select significant P2 incidents.
• Identify underlying security gaps and propose improvement recommendations.
• Produce a formal RCA report with detailed findings, lessons learned, and corrective action plans.