Manager, Threat Intelligence & IR (Hybrid)

For more than 80 years, Kaplan has been a trailblazer in education and professional advancement. We are a global company at the intersection of education and technology, focused on collaboration, innovation, and creativity to deliver a best in class educational experience and make Kaplan a great place to work.

Our offices in India opened in Bengaluru in 2018. Since then, our team has fueled growth and innovation across the organization, impacting students worldwide. We are eager to grow and expand with skilled professionals like you who use their talent to build solutions, enable effective learning, and improve students’ lives.

The future of education is here and we are eager to work alongside those who want to make a positive impact and inspire change in the world around them.

The Manager, Threat Intelligence & IR role leads the KNA organization’s cyber threat intelligence, vulnerability management and remediation, and incident response capabilities across a multi-cloud and multi-platform environment. This position combines a strong solutions architecture background with hands-on operational leadership, designing the detection, response, and remediation architecture while ensuring that threats and exposures are identified, prioritized, and resolved quickly. The role leads a team of analysts and engineers, drives measurable reductions in exposure and response times, and partners with GRC, cloud security, IAM, and engineering teams in support of ISO 27001, NIST, SOX, PCI, and SOC 2 requirements.

• →Lead the enterprise incident response program end to end, serving as incident commander for high-severity events across cloud, on-premises, and SaaS environments. Coordinate containment, eradication, recovery, and post-incident reviews with IT, Legal, Communications, and business leaders to minimize impact and reduce time to detect and respond. Participate in a global on-call rotation that supports follow-the-sun coverage with team members in India.
• →Own the vulnerability management program and remediation lifecycle, including scanning coverage, risk-based prioritization (e.g., CVSS, EPSS, known-exploited status, asset criticality, and exposure), and remediation SLAs. Drive timely remediation with infrastructure, cloud, and application owners, and report on aging, SLA performance, and risk reduction to security leadership.
• →Build and operate the threat intelligence function by collecting, analyzing, and operationalizing intelligence from commercial, open-source, and industry-sharing sources. Translate findings into prioritized vulnerabilities, detection content, threat hunts, and tactical, operational, and strategic briefings mapped to the MITRE ATT&CK framework.
• →Provide solutions architecture leadership for security detection, response, and remediation platforms (e.g., SIEM, SOAR, EDR/XDR, attack surface and cloud security tooling), designing integrations and reference architectures across AWS, Azure, and GCP that are scalable, resilient, and aligned with enterprise standards.
• →Develop, maintain, and test incident response plans, playbooks, and runbooks, and lead tabletop, red team, and purple team exercises. Ensure response capabilities align with ISO 27001, NIST (e.g., SP 800-61 and CSF), SOX, PCI, and SOC 2 obligations, and support client, regulatory, and audit notification requirements.
• →Establish and enforce clear remediation ownership and workflows by partnering with GRC, cloud security, IAM, and engineering teams. Manage exception and risk-acceptance requests, and ensure unresolved exposures are tracked in the risk register with defined owners and target dates.
• →Lead, coach, and develop a team of threat intelligence, incident response, and vulnerability management analysts and engineers, setting clear goals and quality standards. Manage relationships with managed detection and response, forensics, and threat intelligence vendors, and lead technology evaluations and proofs of value.
• →Automate and orchestrate response, enrichment, and remediation workflows using scripting languages, APIs, and orchestration platforms to increase operational efficiency and reduce manual effort and response times.
• →Define and report on key metrics (e.g., mean time to detect, mean time to respond, remediation SLA attainment, and exposure trends), and deliver clear executive-level reporting, incident summaries, and recommendations to the Executive Director of InfoSec and Risk and other senior leaders.
• →Hybrid Schedule: 3 days remote / 2 days in office
• →30-day notification period preferred
  

Minimum Qualifications

• →Bachelor’s degree in Cybersecurity, Computer Science, Information Systems (IS), or related field; or an equivalent combination of training and progressively responsible experience that will result in the required specialized knowledge and abilities to perform the assigned work in lieu of degree.
• →8+ years of information security experience, including 5+ years in incident response and vulnerability management, 3+ years in security solutions architecture, and 2+ years leading or mentoring technical teams.
• →Proven expertise in incident response, including investigation, containment, digital forensics fundamentals, and crisis coordination, with experience serving as incident commander for significant security events.
• →Strong command of enterprise vulnerability management and remediation, including risk-based prioritization, SLA governance, and the ability to drive remediation across engineering and operations teams.
• →Strong solutions architecture background, with demonstrated ability to design and integrate security solutions across multi-cloud (e.g., AWS, Azure, GCP), hybrid, and SaaS environments.
• →Working knowledge of threat intelligence practices and frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain, Diamond Model) and of SIEM, SOAR, EDR/XDR, and detection engineering concepts.
• →Excellent analytical, problem-solving, and communication skills, with the ability to brief both technical and executive audiences and remain effective under pressure.
• →Relevant certifications such as GCIH, GCFA, GCTI, CISSP, or CISM, or an equivalent cloud security or architecture certification, are highly desirable.

Preferred Qualifications

• →Experience applying threat intelligence and incident response practices to AI-specific risks, Gen AI workloads, and cloud-native environments.
• →Ability to automate security and operational tasks using scripting languages (e.g., Python, PowerShell, Bash).
• →Experience in regulated environments, such as education or financial services, subject to SOX, PCI, or privacy requirements.

Kaplan is committed to cultivating an inclusive workplace that values diversity, promotes equity, and integrates inclusivity into all aspects of our operations. We are an equal opportunity employer and all qualified applicants will receive consideration for employment regardless of age, race, creed, color, national origin, ancestry, marital status, sexual orientation, gender identity or expression, disability, veteran status, nationality, or sex. We believe that diversity strengthens our organization, fuels innovation, and improves our ability to serve our students, customers, and communities. Learn more about our culture here.

Kaplan considers qualified applicants for employment even if applicants have an arrest or conviction in their background check records. Kaplan complies with related background check regulations, including but not limited to, the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act.  There are various positions where certain convictions may disqualify applicants, such as those positions requiring interaction with minors, financial records, or other sensitive and/or confidential information.