Cybersecurity Incident Response Analyst

Overview

The Incident Response L1 Analyst is the first line of defence in the cybersecurity incident response function, focused on monitoring, initial detection, triage, and escalation of security incidents across the organization's IT environment.

What you'll do

• Continuously monitor security alerts from SIEM, SOAR, EDR, XDR, email security, and cloud security tools.
• Identify potential security incidents such as phishing and malicious emails, malware and ransomware detections, suspicious logins and account compromise attempts, and endpoint and network anomalies.
• Perform initial investigation and validation of alerts to determine whether they are true positives or false positives.
• Classify incidents based on severity, impact, and urgency.
• Collect and document basic evidence (logs, alerts, affected users/devices, timestamps).
• Execute pre-approved response actions, such as isolating endpoints via EDR, resetting compromised user passwords, blocking malicious IPs, URLs, or senders, and quarantining emails or files.
• Follow Incident Response Playbooks and SOPs.
• Escalate confirmed or high-severity incidents to L2/L3 Incident Responders with complete and accurate context.
• Coordinate with IT, Endpoint, Identity, and Email teams when required and maintain clear communication during active incidents.
• Accurately document incidents in the ticketing or IR management system, maintaining clear timelines, actions taken, and outcomes.
• Support daily/weekly incident reports and metrics.
• Identify recurring issues or alert patterns and raise recommendations.
• Assist in improving detection rules, playbooks, and response workflows.
• Stay updated on emerging threats, attack techniques, and security best practices.

What you'll need

• Basic understanding of cybersecurity fundamentals (CIA triad, attack lifecycle).
• Basic understanding of common attack types (phishing, malware, brute force, ransomware).
• Basic understanding of Windows, macOS, and basic Linux concepts.
• Familiarity with security tools such as SIEM (e.g., Microsoft Sentinel, Splunk).
• Familiarity with security tools such as EDR/XDR (e.g., Microsoft Defender, CrowdStrike).
• Familiarity with email security and web security gateways.
• Basic log analysis and alert interpretation skills.
• Strong attention to detail.
• Ability to follow processes and playbooks accurately.
• Calm and methodical approach during security incidents.
• Good written and verbal communication.
• Willingness to work in shifts / 24x7 environment.
• 2+ years of experience in SOC, IR, or IT Security roles.

Nice to have

• Bachelor's degree in IT, Computer Science, Cybersecurity, or related field.
• Entry-level cybersecurity certifications: CompTIA Security+, Microsoft SC-900 / SC-200, CEH (Foundation level).

Details

• Location: Mumbai, India.
• Shift work in a 24x7 environment.