Job Description:
About Organization
Cyber Defense Operations Section operates a 24/7 Security Operations Center (SOC) protecting Rakuten Group's critical infrastructure. We are currently in a critical transformation phase to address the era of autonomous, AI-driven cyber threats. Our goal is to evolve from a reactive monitoring unit into a proactive, intelligence-led, and autonomous defense organization. We are seeking a visionary and hands-on SOC Lead to architect our future-ready security operations, leveraging AI and automation to neutralize machine-speed attacks while mentoring high-performing security talent.
Job Duties
- Strategic Transformation: Lead the evolution of the SOC from a reactive monitoring unit to an autonomous, AI-augmented defense organization.
- AI & Automation Engineering: Architect and implement AI-driven detection and response workflows. Drive the integration of SOAR (Security Orchestration, Automation, and Response) to counter autonomous AI attacks.
- Operational Leadership: Manage the 24/7 SOC team, ensuring high-availability monitoring, rapid incident response, and continuous service improvement.
- Technical Oversight: Provide L3-level escalation support for complex incidents. Oversee security monitoring of Telco-specific network architectures, containerized environments, and Kubernetes (K8s) clusters.
- Governance & Documentation: Establish rigorous SOC governance, including the creation and maintenance of playbooks and SOPs that meet international audit and compliance standards.
- DFIR & Root Cause Analysis: Assist in high-stakes Digital Forensics and Incident Response (DFIR) efforts, conducting deep-dive analysis to harden the environment against future threats.
- Stakeholder Collaboration: Partner with cross-functional security teams and Business Units to ensure security is integrated throughout the infrastructure lifecycle.
- Innovation & Research: Stay at the bleeding edge of offensive and defensive AI research to proactively adapt security posture against evolving adversary tactics.
Minimum Qualifications
- Leadership: Proven experience leading technical teams in a 24/7 environment; demonstrated ability to mentor and grow security talent.
- AI/ML in Security: Deep understanding of leveraging AI for threat hunting, anomaly detection, and automated response.
- Telco & Infrastructure: Strong experience in a Telco environment, including knowledge of SS7/Diameter/GTP protocols, 5G core security, and virtualization.
- Cloud-Native Security: Expert-level knowledge of containerization (Docker) and Kubernetes (K8s) security.
- Automation: Advanced scripting skills (Python, Go, or Bash) and extensive experience with SOAR platforms.
- DFIR: Expert capability in conducting digital forensics and managing incident response lifecycles.
- Experience: 10+ years in Cyber Security, with at least 6 years in a leadership role within a SOC.
- Education: Bachelor's or Master's degree in Computer Science, Cyber Security, or a related field.
- Certifications: Relevant industry certifications (e.g., CISSP, CISM, GCIH, GCFA, or equivalent).
Preferred Qualifications
- Experience with LLM-based security tools or "AI-vs-AI" defense strategies.
- Experience in high-traffic, low-latency environments typical of modern Telecommunications.
- Active participation in the security community (e.g., public speaking, research papers, or open-source security tool development).
- Experience with cloud security (AWS/Azure/GCP) in a hybrid-Telco environment.
Work Environment
- Reporting: Reports to the Head of Cyber Defense Operations Section.
- Collaboration: Manages the 24/7 SOC team and collaborates cross-departmentally with other security functions and Business Units.
- Tech Stack: Containerization (Docker/K8s), Telco environment (5G Core, Signaling Protocols), SOAR platforms, Python/Go/Bash, Cloud Security (AWS/Azure/GCP), and LLM-based security tools.
Languages:
English (Overall - 3 - Advanced)
