Department Manager - Cyber Incident Management (Incident Response)

This role involves owning the end-to-end incident response lifecycle, acting as Incident Commander during major security events, and managing the SOC team's operational effectiveness. The manager will build and mature the incident response programme by developing scenario-specific playbooks, driving post-incident reviews, and executing tabletop exercises. Responsibilities include managing KPIs like MTTD and MTTR, maintaining threat intelligence pipelines, and coordinating with legal and compliance teams during regulatory incidents.

Serve as Incident Commander for Severity-1 and Severity-2 security incidents

Build and maintain the incident response playbook library

Drive post-incident reviews (PIRs) for significant incidents

Own and improve SOC operational KPIs

Design and execute quarterly tabletop exercises

Manage relationships with MSSP/MDR providers

Develop and maintain the incident communication framework

Coordinate with legal, compliance, and communications teams

Maintain the threat intelligence integration pipeline

Build incident response capabilities in the SOC team

Experience with EDR/XDR platforms (Cortex XDR, CrowdStrike)

Experience with SIEM/SOAR (Splunk, Microsoft Sentinel)

Knowledge of attack frameworks (MITRE ATT&CK, Cyber Kill Chain)

Strong communication skills for executive briefings

Fluent in Thai; working English proficiency

Unknown