Lead - Digital Forensics & Incident Response

Digital Forensics & Incident Response (DFIR) Analyst / Senior Analyst / Lead.

Location: Navi Mumbai (Onsite)

Working Hours: 6 days working (2nd & 4th Saturday off).

Regular Shift: 10:30AM - 6:30PM.

Position Summary:

We are hiring Digital Forensics & Incident Response (DFIR) professionals to support in detecting, investigating, containing, and responding to cybersecurity incidents. The selected candidates will work on digital forensic investigations, malware analysis, incident response, threat hunting, attack reconstruction, and cyber crisis management to strengthen the security posture.

Key Responsibilities:

- Monitor, triage, and investigate security incidents received from SIEM, EDR, NDR, XDR, email security, cloud security platforms, and threat intelligence feeds.

- Perform evidence collection from Windows, Linux, Active Directory, cloud platforms, endpoints, firewalls, and network devices.

- Maintain proper chain of custody and forensic evidence handling procedures.

- Lead investigations involving malware, ransomware, insider threats, cloud compromises, identity attacks, data exfiltration, and advanced cyber incidents.

- Lead enterprise incident response for high-severity cybersecurity incidents.

- Develop and maintain enterprise incident response frameworks, forensic standards, playbooks, and crisis communication plans.

- Drive DFIR automation using SOAR and orchestration platforms.

- Mentor junior analysts and contribute to capability development across the DFIR function.

Technical Expertise:

Candidates should have knowledge or experience in Incident Response, Digital Forensics, Malware Analysis, Ransomware Investigation, Cloud Incident Response, Threat Hunting, and Root Cause Analysis.

Preferred Tools:

Microsoft Defender XDR, Microsoft Sentinel, CrowdStrike Falcon, SentinelOne, Cortex XDR, Splunk, IBM QRadar, Velociraptor, FTK Imager, EnCase, Magnet AXIOM, Autopsy, Volatility, KAPE, Wireshark, CyberChef, VirusTotal, MISP, Cortex XSOAR, ServiceNow Security Operations.

Required Skills:

Digital Forensics, Incident Response, Malware Analysis, Memory & Disk Forensics, Network Forensics, Cloud Forensics, Threat Hunting, SIEM & EDR Analysis, IOC Analysis, Windows & Linux Internals, Active Directory Security, Networking Fundamentals, MITRE ATT&CK Framework, Evidence Preservation & Chain of Custody, Root Cause Analysis, Cyber Crisis Management, SOAR & Security Automation, Executive Communication.