Manager, Threat Intelligence & IR (Hybrid)

Job Title
Manager, Threat Intelligence & IR (Hybrid)
Job Description
For more than 80 years, Kaplan has been a trailblazer in education and professional advancement. We are a global company at the intersection of education and technology, focused on collaboration, innovation, and creativity to deliver a best in class educational experience and make Kaplan a great place to work.

Our offices in India opened in Bengaluru in 2018. Since then, our team has fueled growth and innovation across the organization, impacting students worldwide. We are eager to grow and expand with skilled professionals like you who use their talent to build solutions, enable effective learning, and improve students’ lives.

The future of education is here and we are eager to work alongside those who want to make a positive impact and inspire change in the world around them.

The Manager, Threat Intelligence & IR role leads the KNA organization’s cyber threat intelligence, vulnerability management and remediation, and incident response capabilities across a multi-cloud and multi-platform environment. This position combines a strong solutions architecture background with hands-on operational leadership, designing the detection, response, and remediation architecture while ensuring that threats and exposures are identified, prioritized, and resolved quickly. The role leads a team of analysts and engineers, drives measurable reductions in exposure and response times, and partners with GRC, cloud security, IAM, and engineering teams in support of ISO 27001, NIST, SOX, PCI, and SOC 2 requirements.

Primary/Key Responsibilities

- Lead the enterprise incident response program end to end, serving as incident commander for high-severity events across cloud, on-premises, and SaaS environments. Coordinate containment, eradication, recovery, and post-incident reviews with IT, Legal, Communications, and business leaders to minimize impact and reduce time to detect and respond. Participate in a global on-call rotation that supports follow-the-sun coverage with team members in India.

- Own the vulnerability management program and remediation lifecycle, including scanning coverage, risk-based prioritization (e.g., CVSS, EPSS, known-exploited status, asset criticality, and exposure), and remediation SLAs. Drive timely remediation with infrastructure, cloud, and application owners, and report on aging, SLA performance, and risk reduction to security leadership.

- Build and operate the threat intelligence function by collecting, analyzing, and operationalizing intelligence from commercial, open-source, and industry-sharing sources. Translate findings into prioritized vulnerabilities, detection content, threat hunts, and tactical, operational, and strategic briefings mapped to the MITRE ATT&CK framework.

- Provide solutions architecture leadership for security detection, response, and remediation platforms (e.g., SIEM, SOAR, EDR/XDR, attack surface and cloud security tooling), designing integrations and reference architectures across AWS, Azure, and GCP that are scalable, resilient, and aligned with enterprise standards.

- Develop, maintain, and test incident response plans, playbooks, and runbooks, and lead tabletop, red team, and purple team exercises. Ensure response capabilities align with ISO 27001, NIST (e.g., SP 800-61 and CSF), SOX, PCI, and SOC 2 obligations, and support client, regulatory, and audit notification requirements.

- Establish and enforce clear remediation ownership and workflows by partnering with GRC, cloud security, IAM, and engineering teams. Manage exception and risk-acceptance requests, and ensure unresolved exposures are tracked in the risk register with defined owners and target dates.

- Lead, coach, and develop a team of threat intelligence, incident response, and vulnerability management analysts and engineers, setting clear goals and quality standards. Manage relationships with managed detection and response, forensics, and threat intelligence vendors, and lead technology evaluations and proofs of value.

- Automate and orchestrate response, enrichment, and remediation workflows using scripting languages, APIs, and orchestration platforms to increase operational efficiency and reduce manual effort and response times.

- Define and report on key metrics (e.g., mean time to detect, mean time to respond, remediation SLA attainment, and exposure trends), and deliver clear executive-level reporting, incident summaries, and recommendations to the Executive Director of InfoSec and Risk and other senior leaders.

- Hybrid Schedule: 3 days remote / 2 days in office

- 30-day notification period preferred

Minimum Qualifications

- Bachelor’s degree in Cybersecurity, Computer Science, Information Systems (IS), or related field; or an equivalent combination of training and progressively responsible experience that will result in the required specialized knowledge and abilities to perform the assigned work in lieu of degree.

- 8+ years of information security experience, including 5+ years in incident response and vulnerability management, 3+ years in security solutions architecture, and 2+ years leading or mentoring technical teams.

- Proven expertise in incident response, including investigation, containment, digital forensics fundamentals, and crisis coordination, with experience serving as incident commander for significant security events.

- Strong command of enterprise vulnerability management and remediation, including risk-based prioritization, SLA governance, and the ability to drive remediation across engineering and operations teams.

- Strong solutions architecture background, with demonstrated ability to design and integrate security solutions across multi-cloud (e.g., AWS, Azure, GCP), hybrid, and SaaS environments.

- Working knowledge of threat intelligence practices and frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain, Diamond Model) and of SIEM, SOAR, EDR/XDR, and detection engineering concepts.

- Excellent analytical, problem-solving, and communication skills, with the ability to brief both technical and executive audiences and remain effective under pressure.

- Relevant certifications such as GCIH, GCFA, GCTI, CISSP, or CISM, or an equivalent cloud security or architecture certification, are highly desirable.

Preferred Qualifications

- Experience applying threat intelligence and incident response practices to AI-specific risks, Gen AI workloads, and cloud-native environments.

- Ability to automate security and operational tasks using scripting languages (e.g., Python, PowerShell, Bash).

- Experience in regulated environments, such as education or financial services, subject to SOX, PCI, or privacy requirements.

Beyond base salary, our comprehensive total rewards package includes:

Hybrid work model provides a flexible work/life balance
Voluntary Provident Fund is an additional voluntary contribution scheme associated with the statutory Employee Provident Fund (EPF)
Our Gift of Knowledge Program provides tuition assistance and substantial discounts for our employees and close family members
Comprehensive health benefits new hire eligibility starts on day 1 of employment
Generous Paid Time Off includes National holidays(10), Earned leaves(15), sick leave(12), plus one (1) volunteer day to participate and give back to our local communities
Gratuity is applicable upon completion of 5 years as per the Gratuity Act

We are committed to providing a supportive and rewarding work environment where every employee can thrive. You can learn more about our full benefits package and total rewards philosophy here.

At Kaplan, we believe in attracting, rewarding, and retaining exceptional talent. Our compensation philosophy is designed to be competitive within the market, reflecting the value we place on the skills, experience, and contributions of our employees, while taking into account labor market trends and total rewards. The specific compensation offered will be determined by a variety of factors, including but not limited to the candidate's qualifications, relevant experience, education, skills, and market data.

Location
Bangalore, KA, India
Additional Locations

Employee Type
Employee
Job Functional Area
Information Security
Business Unit
00091 Kaplan Higher ED
Diversity & Inclusion Statement :

Kaplan is committed to cultivating an inclusive workplace that values diversity, promotes equity, and integrates inclusivity into all aspects of our operations. We are an equal opportunity employer and all qualified applicants will receive consideration for employment regardless of age, race, creed, color, national origin, ancestry, marital status, sexual orientation, gender identity or expression, disability, veteran status, nationality, or sex. We believe that diversity strengthens our organization, fuels innovation, and improves our ability to serve our students, customers, and communities. Learn more about our culture here .

Kaplan considers qualified applicants for employment even if applicants have an arrest or conviction in their background check records. Kaplan complies with related background check regulations, including but not limited to, the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act.  There are various positions where certain convictions may disqualify applicants, such as those positions requiring interaction with minors, financial records, or other sensitive and/or confidential information.

Kaplan is a drug-free workplace and complies with applicable laws.