Job Description

You will join the Cybersecurity Product Sustained Engineering team, responsible for the Splunk SIEM platform and other technology supporting Global Cybersecurity Operations.  The team manages all aspects of the AWS hosted Cybersecurity platforms as well as on-premises data ingestion infrastructure and forensics services.

The Security Incident Response (SIR) Administrator role is responsible for the day-to-day administration, support and continuous improvement of the SIR Platform, ensuring it effectively enables the Global Cybersecurity Operations (GCO) Teams to manage and process potential security incidents.  The role oversees the configuration, maintenance, and enhancement of workflows, playbooks, integrations and reporting.

In addition, the role manages the Security Incident Response (SIR) POD, co-ordinating and prioritising releases, providing technical guidance and ensuring platform changes are deliver in line with organisational requirements.

͏

• Running a small team of SIR Specialists, integrating the wider ServiceNow development community across HSBC and building processes & procedures for the SIR POD, ensuring control compliance
• Administering, maintaining and supporting the ServiceNow Security Incident Response (SIR) Module
• Designing, implementing and maintaining robust RBAC models for SIR
• Supporting the integration of security tools such as SIEM, SOAR & EDR
• Co-ordinating and supporting platform upgrades, testing and new feature implementations
• Managing & communicating releases for SIR
• Product development lifecycle and roadmap planning
• Process ownership for change delivery and incident handling
• Managing documentation space and ownership of templates for process definitions, implementation plans and troubleshooting activities

͏

What you will bring to the role:

To be successful in this role you should have proven experience within the technology sector with the following skills:

• Expertise in administering ServiceNow SIR
• Understanding of security incident response processes and lifecycles
• Experience configuring workflows, forms, access controls and notifications
• Strong troubleshooting and problem-solving skills
• Excellent stakeholder management skills
• Expertise in agile delivery, including Jira and Confluence
• An ability to communicate complex and technical issues to diverse audiences in business language
• Self-motivated and possessing of a high sense of urgency and personal integrity

• A team-focused mentality with the proven ability to work effectively with diverse stakeholders

• Ability to orchestrate, manage and successfully implement major procedural and technological change within a complex, global organization

Required Qualifications

• ServiceNow Certified System Administrator (CSA)
• Certified Implementation Specialist – Data Foundations (CMDB and CSDM) (CIS-DF (CMDB and CSDM))
• Security Incident Response (CIS-SIR)

This role is based in Hyderabad, India.

Come Power a Business that Defines How to Power the World

As a business operating in markets all around the world, we believe diversity brings benefits for our customers, our business and our people. This is why HSBC UK is committed to being an inclusive employer and encourages applications from all suitably qualified applicants irrespective of background, circumstances, age, disability, gender identity, ethnicity, religion or belief and sexual orientation. 

We want everyone to be able to fulfil their potential, which is why we provide a range of flexible working arrangements and family friendly policies.

As an HSBC employee in the UK, you will have access to tailored professional development opportunities and a competitive pay and benefits package. This includes private healthcare for all UK-based employees, enhanced maternity and adoption pay and support when you return to work, and a contributory pension scheme with a generous employer contribution.

Personal data held by the Bank relating to employment applications will be used in accordance with our Privacy Statement, which is available on our website.