Job Title
Manager, Threat Intelligence & IR (Hybrid)
Job Description
For more than 80 years, Kaplan has been a trailblazer in education and professional advancement. We are a global company at the intersection of education and technology, focused on collaboration, innovation, and creativity to deliver a best in class educational experience and make Kaplan a great place to work.
Our offices in India opened in Bengaluru in 2018. Since then, our team has fueled growth and innovation across the organization, impacting students worldwide. We are eager to grow and expand with skilled professionals like you who use their talent to build solutions, enable effective learning, and improve students’ lives.
The future of education is here and we are eager to work alongside those who want to make a positive impact and inspire change in the world around them.
The Manager, Threat Intelligence & IR role leads the KNA organization’s cyber threat intelligence, vulnerability management and remediation, and incident response capabilities across a multi-cloud and multi-platform environment. This position combines a strong solutions architecture background with hands-on operational leadership, designing the detection, response, and remediation architecture while ensuring that threats and exposures are identified, prioritized, and resolved quickly. The role leads a team of analysts and engineers, drives measurable reductions in exposure and response times, and partners with GRC, cloud security, IAM, and engineering teams in support of ISO 27001, NIST, SOX, PCI, and SOC 2 requirements.
Primary/Key Responsibilities
Lead the enterprise incident response program end to end, serving as incident commander for high-severity events across cloud, on-premises, and SaaS environments. Coordinate containment, eradication, recovery, and post-incident reviews with IT, Legal, Communications, and business leaders to minimize impact and reduce time to detect and respond. Participate in a global on-call rotation that supports follow-the-sun coverage with team members in India.
Own the vulnerability management program and remediation lifecycle, including scanning coverage, risk-based prioritization (e.g., CVSS, EPSS, known-exploited status, asset criticality, and exposure), and remediation SLAs. Drive timely remediation with infrastructure, cloud, and application owners, and report on aging, SLA performance, and risk reduction to security leadership.
Build and operate the threat intelligence function by collecting, analyzing, and operationalizing intelligence from commercial, open-source, and industry-sharing sources. Translate findings into prioritized vulnerabilities, detection content, threat hunts, and tactical, operational, and strategic briefings mapped to the MITRE ATT&CK framework.
Provide solutions architecture leadership for security detection, response, and remediation platforms (e.g., SIEM, SOAR, EDR/XDR, attack surface and cloud security tooling), designing integrations and reference architectures across AWS, Azure, and GCP that are scalable, resilient, and aligned with enterprise standards.
Develop, maintain, and test incident response plans, playbooks, and runbooks, and lead tabletop, red team, and purple team exercises. Ensure response capabilities align with ISO 27001, NIST (e.g., SP 800-61 and CSF), SOX, PCI, and SOC 2 obligations, and support client, regulatory, and audit notification requirements.
Establish and enforce clear remediation ownership and workflows by partnering with GRC, cloud security, IAM, and engineering teams. Manage exception and risk-acceptance requests, and ensure unresolved exposures are tracked in the risk register with defined owners and target dates.
Lead, coach, and develop a team of threat intelligence, incident response, and vulnerability management analysts and engineers, setting clear goals and quality standards. Manage relationships with managed detection and response, forensics, and threat intelligence vendors, and…