Principal Engineer - Digital Forensics

Overview

Principal Engineer defining long-term engineering solutions for highly complex business and technical needs across multiple groups or the enterprise, with a focus on digital forensics, incident response and threat hunting.

What you'll do

• Advise leadership on applications, networks, information security, databases, operating systems, or web technologies for highly complex business and technical needs across multiple groups
• Lead strategy and resolution of highly complex and unique challenges requiring in-depth evaluation across multiple areas or the enterprise
• Translate advanced technology experience, business objectives, enterprise technology environments, organizational structures, and strategic opportunities into technical engineering solutions
• Provide vision, direction, and expertise to leadership on innovative and significant business solutions
• Maintain knowledge of industry practices and emerging technologies and recommend innovations that enhance operations or competitive position
• Strategically engage with professionals and managers across the enterprise and serve as a technical advisor to leadership
• Perform Tier 3 investigation on critical cyber cases in a 24*7 environment
• Conduct forensic analysis of cyber incidents including hacking, malware attacks, data breaches and insider threats
• Identify, preserve, extract and analyze digital evidence from computers, mobile devices, servers, cloud systems, and other digital storage media
• Use industry-standard forensic tools and techniques (e.g., FTK, EnCase, X-Ways, Autopsy, Volatility, Cellebrite) to uncover evidence and trace cyber attackers
• Lead and execute advanced digital forensic investigations involving endpoint, cloud, network, mobile, email, and SaaS platforms to determine root cause, impact, data exposure, and attacker methodology
• Design, develop and maintain scalable forensic acquisition and analysis workflows, including custom scripts, artifact parsers, and automation to improve investigation efficiency and reduce manual effort
• Serve as Incident Commander during major security events, coordinating cross-functional technical teams, legal, compliance, risk, and executive leadership to drive timely containment and eradication actions
• Conduct threat hunting activities leveraging SIEM, EDR, network telemetry, and intelligence sources to proactively identify indicators of compromise (IOCs), anomalous behaviors, and emerging threats targeting the financial sector
• Develop and maintain incident response playbooks and standard operating procedures, ensuring alignment with regulatory requirements, industry frameworks, and evolving threat landscapes
• Build and maintain forensic readiness capabilities, including logging strategy, chain-of-custody processes, evidence retention standards, forensic imaging workflows, and tooling optimization
• Collaborate with Fraud, Legal, Compliance, Privacy, and internal Audit teams to support investigations involving insider threats, data misuse, fraud activity, and regulatory reporting
• Perform malware triage and reverse-engineering (as appropriate) to evaluate malicious payloads, persistence mechanisms, pivot paths, and risk to the institution, providing actionable intelligence to detection engineering teams
• Drive continuous improvement of detection and response capabilities by identifying monitoring gaps, recommending new security technologies, tuning alerts, and contributing to security architecture reviews
• Prepare high-quality written reports and executive-level briefs summarizing findings, incident timelines, business impact, and recommendations for remediation and long-term risk reduction
• Mentor and provide technical leadership to junior analysts, delivering training in forensic methodologies, investigative techniques, threat analysis, tool usage, and incident response best practices

What you'll need

• 7+ years of Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education

Nice to have

• 7+ years of focused professional experience in DFIR, threat hunting, and digital forensics within highly regulated industries (financial services preferred) or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education
• Proven experience leading complex, multi-team, enterprise-wide programs in highly regulated organizations
• Strong knowledge of digital forensics and incident response principles, tooling, and frameworks (e.g., case management systems, SOAR, log pipelines, forensics investigations, event triage)
• Familiarity with SOC and IR functions, threat intelligence, detection engineering, and crisis management
• Experience with SIEM tools like Splunk, Crowdstrike etc.
• Proficiency with program and project management tools and frameworks (e.g., JIRA, Confluence, Smartsheet, MS Project, SAFe, Agile, Waterfall/Hybrid)
• Demonstrated proficiency in Python, PowerShell or equivalent scripting languages with practical experience automating forensic evidence collection, processing and investigative workflows
• Exceptional communication skills, including executive-level reporting, stakeholder engagement, and risk management
• Ability to operate effectively across highly technical and non-technical domains, balancing operational needs with engineering constraints and business priorities
• Proven ability to analyze malware and malicious artifacts, including dynamic and static analysis, memory forensics, and identification of persistence mechanisms (formal reverse-engineering experience is a plus)
• Demonstrated expertise in cloud incident response (AWS, Azure, or GCP), including log analysis, IAM investigations, container workload forensics, and cloud-native security tooling

Details

• Location: Bengaluru, India
• Operates in a 24*7 environment
• Posting end date: 16 Nov 2026