Senior Security Consultant

Overview

Senior Cybersecurity Incident Response Specialist to manage and investigate security incidents across enterprise environments, with end-to-end ownership from triage through closure and strong customer-facing responsibilities.

What you'll do

• Take end-to-end ownership of cybersecurity incidents from initial detection through closure.
• Lead investigation of Critical, High, and complex security incidents and coordinate response activities across relevant teams.
• Perform incident triage, scoping, containment, eradication, recovery, and post-incident analysis.
• Investigate incidents involving ransomware, malware, phishing, account compromise, credential theft, data exfiltration, insider threats, web attacks, lateral movement, privilege escalation, and other advanced threats.
• Analyze security alerts and correlate information across EDR, SIEM, network, identity, cloud, email, and other security technologies.
• Develop incident timelines and determine the attack vector, affected assets, compromised accounts, attacker activity, persistence mechanisms, and overall impact.
• Identify Indicators of Compromise (IOCs) and attacker Tactics, Techniques, and Procedures (TTPs), and map findings to the MITRE ATT&CK framework.
• Coordinate with SOC, Threat Hunting, Threat Intelligence, IT, Cloud, Network, IAM, Application, Legal, and other stakeholders during major incidents.
• Perform detailed Root Cause Analysis for security incidents, determining the initial attack vector, contributing factors, control gaps, and why existing controls did not stop or detect the activity earlier.
• Conduct post-incident reviews and lessons-learned sessions.
• Develop clear corrective and preventive actions and track remediation recommendations with relevant stakeholders through closure.
• Prepare comprehensive RCA reports suitable for technical teams, management, and customers.
• Perform static and dynamic malware analysis, including analysis of suspicious executables, scripts, PowerShell commands, documents, URLs, and other artifacts.
• Identify malware persistence mechanisms, command-and-control activity, network indicators, file-system changes, registry modifications, and related behaviors.
• Extract IOCs and behavioral indicators for threat hunting and detection engineering, and perform malware sandboxing and behavioral analysis where required.
• Provide recommendations for detection, containment, and prevention based on malware-analysis findings.
• Perform digital forensic investigations on endpoints and other relevant systems, including analysis of Windows/Linux artifacts, event logs, file systems, registry, browser, authentication, and memory artifacts.
• Perform disk and memory analysis where required.
• Collect and preserve digital evidence following forensic procedures and chain-of-custody requirements.
• Build forensic timelines, reconstruct attacker activities, and determine the scope and impact of compromise.
• Act as a key technical point of contact for customers during cybersecurity incidents, leading incident calls and communicating progress, impact, containment status, risks, and next steps.
• Translate complex technical investigation findings into clear business-level communication and manage customer expectations during high-severity incidents.
• Present RCA and forensic investigation findings to customers and senior stakeholders, and explain methodology, evidence, conclusions, and recommendations.
• Prepare detailed incident investigation reports covering executive summary, incident timeline, scope and impact, root cause, attack vector, IOCs and TTPs, investigation findings, containment and remediation actions, control gaps, corrective and preventive recommendations, and lessons learned.
• Maintain accurate incident records, evidence, investigation notes, and supporting documentation.
• Contribute to the development and improvement of Incident Response playbooks, SOPs, investigation procedures, and escalation processes.

What you'll need

• 8–10 years of overall cybersecurity experience, with significant hands-on experience in Incident Response, DFIR, SOC, Threat Hunting, or related security domains.
• Demonstrated experience independently handling complex and high-severity cybersecurity incidents.
• Strong experience conducting RCA and presenting investigation findings.
• Hands-on experience with malware and forensic investigations.
• Experience handling customer-facing security incidents and leading technical/customer incident calls.
• Experience coordinating investigations involving multiple technical and business teams.
• Ability to work effectively under pressure during Critical/High-severity incidents.
• Strong analytical, troubleshooting, and problem-solving skills.
• Hands-on experience in Cybersecurity Incident Response / DFIR, Security Incident Investigation, Root Cause Analysis, Digital Forensics, Malware Analysis, Threat Hunting, Endpoint and Network Investigation, Windows and Linux Forensics, Disk and Memory Analysis, Log Analysis and Timeline Reconstruction, IOC and TTP Analysis, and the MITRE ATT&CK Framework.
• Experience with SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, or similar.
• Experience with EDR/XDR platforms such as CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, Cortex XDR, or similar.
• Experience with network security technologies including Firewall, IDS/IPS, Proxy, DNS, VPN, and WAF.
• Cloud security investigation experience across AWS, Azure, and/or GCP environments.
• Identity and authentication-related investigation experience.
• Email and phishing investigation experience.
• Experience with forensic and malware-analysis tools such as Volatility, Autopsy, FTK, EnCase, Wireshark, Sysinternals, YARA, Ghidra, IDA, or equivalent tools.
• Excellent verbal and written communication skills.
• Strong customer-facing and stakeholder-management capabilities.
• Ability to communicate effectively with both technical and non-technical stakeholders.
• Ability to lead incident bridges/calls during critical incidents.
• Strong documentation and report-writing skills.
• Ability to take ownership, make investigation decisions, and drive incidents to closure.
• Ability to mentor junior Incident Response/SOC analysts and provide technical guidance during investigations.

Nice to have

• Scripting/automation experience using Python, PowerShell, or similar technologies.

Details

• Location: Hyderabad.