Senior Incident Response Analyst

<h3>Accountabilities</h3><li>
<strong>Lead incident investigations:</strong>Investigate, analyze, and respond to active cybersecurity incidents using available security technologies and investigative methodologies to identify threats and disrupt malicious activity.</li><li>
<strong>Contain and remediate cyber threats:</strong>Identify initial access methods, persistence mechanisms, lateral movement, and other adversary behaviors, providing actionable recommendations to contain attacks, neutralize threats, and support remediation.</li><li>
<strong>Analyze malware and ransomware:</strong>Conduct in-depth investigations into ransomware, malware, and other common cyberattack types to determine their scope, impact, and associated indicators of compromise.</li><li>
<strong>Support MDR customers and service providers:</strong>Work directly with customers and managed service providers through calls and meetings to explain incident findings, communicate response priorities, and provide clear technical guidance throughout investigations.</li><li>
<strong>Perform endpoint and network investigations:</strong>Analyze security events across Windows, Linux, and macOS environments, investigating network activity, endpoint telemetry, and relevant security alerts to determine the extent of compromise.</li><li>
<strong>Mentor and guide analysts:</strong>Provide technical guidance, investigation reviews, and escalation support to incident response analysts and MDR operations teams, helping strengthen investigative quality and response effectiveness.</li><li>
<strong>Collaborate with security specialists:</strong>Partner with threat intelligence, detection engineering, threat hunting, and MDR operations teams to improve detection logic, share investigative findings, and enhance organizational response capabilities.</li><li>
<strong>Maintain detailed investigation records:</strong>Document investigative procedures, evidence, findings, indicators of compromise, and response actions accurately to support transparency, reproducibility, and effective incident management.</li><li>
<strong>Prepare technical incident reports:</strong>Produce comprehensive post-incident reports for customers and service providers, outlining the attack timeline, investigation results, impact, and recommended remediation measures.</li><li>
<strong>Apply recognized threat frameworks:</strong>Use established cybersecurity frameworks and adversary behavior models to structure investigations, understand attack progression, and communicate findings consistently.</li><li>
<strong>Improve incident response capabilities:</strong>Evaluate emerging technologies, tools, and processes to identify opportunities to improve investigation efficiency, response quality, and threat containment.</li><li>
<strong>Contribute to threat research and knowledge sharing:</strong>Where appropriate, share technical insights through articles, blogs, social media, and other professional channels covering adversary tactics, techniques, procedures, and investigative findings.</li><li>
<strong>Maintain high-quality customer service:</strong>Communicate clearly and professionally during high-pressure incidents, helping customers understand risks, prioritize actions, and make informed decisions.</li><li>
<strong>Provide flexible incident coverage:</strong>Support incident response operations during occasional weekends and holidays when required to address urgent cybersecurity events.</li><h2>Requirements</h2><li>
<strong>Relevant cybersecurity experience:</strong>At least 4 years of experience conducting structured cybersecurity investigations or at least 2 years of direct experience handling incident response engagements.</li><li>
<strong>Network and IT infrastructure knowledge:</strong>Strong understanding of network architecture, IT infrastructure, network communications, and the security principles needed to investigate complex cyber incidents.</li><li>
<strong>Endpoint and network investigation skills:</strong>Hands-on experience investigating Windows, Linux, and macOS environments, with knowledge of intrusion detection and prevention systems (IDS/IPS), endpoint detection and response (EDR), and basic malware analysis.</li><li>
<strong>Incident response expertise:</strong>Ability to investigate security incidents methodically, identify attack vectors and adversary activity, assess incident scope, and recommend effective containment and remediation measures.</li><li>
<strong>Threat analysis and investigative frameworks:</strong>Experience applying frameworks such as MITRE ATT&amp;CK and the Cyber Kill Chain to understand attack techniques, structure investigations, and support incident reporting.</li><li>
<strong>Querying and investigative tools:</strong>Working knowledge of at least one of the following: osquery, SQL, or Kusto Query Language (KQL).</li><li>
<strong>Operating system and scripting knowledge:</strong>Familiarity with Windows and Linux command-line environments and scripting interpreters to support investigations, evidence collection, and technical analysis.</li><li>
<strong>Technical reporting and documentation:</strong>Demonstrated ability to produce accurate, detailed technical documentation and customer-facing incident reports that clearly explain findings and recommended actions.</li><li>
<strong>Customer communication:</strong>Strong verbal and written communication skills, with the ability to discuss complex security incidents, explain technical findings, and provide practical recommendations to customers and service providers.</li><li>
<strong>Performance under pressure:</strong>Ability to make sound, context-driven decisions during time-sensitive security incidents while maintaining investigative accuracy and prioritizing actions that disrupt adversary activity.</li><li>
<strong>Teamwork and mentoring:</strong>Ability to collaborate effectively with multidisciplinary security teams, provide constructive technical guidance, review investigative work, and support the development of other analysts.</li><li>
<strong>Adaptability and availability:</strong>Willingness to work occasional weekends and holidays and respond effectively to urgent incidents in a fast-paced security operations environment.</li><li>
<strong>Preferred certifications:</strong>Advanced cybersecurity certifications such as GIAC Certified Forensic Examiner (GCFE), GIAC Certified Forensic Analyst (GCFA), CompTIA Cybersecurity Analyst (CySA+), or Offensive Security Certified Professional (OSCP) are advantageous.</li><li>
<strong>Additional preferred experience:</strong>Previous experience providing customer-facing incident response services, handling customer calls, or delivering technical security guidance is beneficial.</li><li>
<strong>Industry contributions:</strong>Published cybersecurity research, articles, technical content, or acknowledged contributions to the cybersecurity community are an advantage.</li><li>
<strong>Remote working readiness:</strong>Ability to work independently and collaborate effectively with distributed teams. Applicants must be legally authorized to work in India without requiring employer sponsorship.</li><h2>Benefits</h2><li>
<strong>Remote-first working model:</strong>Work remotely from India, with flexibility suited to a distributed global team.</li><li>
<strong>Professional development:</strong>Opportunities to deepen expertise in incident response, digital forensics, threat intelligence, malware analysis, and advanced security operations.</li><li>
<strong>Collaborative technical environment:</strong>Work alongside experienced cybersecurity specialists across incident response, detection engineering, threat hunting, and MDR operations.</li><li>
<strong>Continuous learning:</strong>Access to wellbeing webinars, training opportunities, and knowledge-sharing initiatives that support professional and personal development.</li><li>
<strong>Employee wellbeing:</strong>Participate in global wellbeing days designed to help employees relax, recharge, and maintain a healthy work-life balance.</li><li>
<strong>Fitness and engagement initiatives:</strong>Take part in global fitness challenges, trivia competitions, and other employee engagement activities.</li><li>
<strong>Inclusive workplace culture:</strong>Join an environment that values diverse perspectives, equal opportunity, collaboration, and mutual respect.</li><li>
<strong>Employee-led communities:</strong>Opportunities to participate in diversity and inclusion networks that promote education, advocacy, and community building.</li><li>
<strong>Community involvement:</strong>Participate in charitable initiatives, fundraising activities, and volunteer days supporting local communities.</li><li>
<strong>Sustainability initiatives:</strong>Contribute to global employee programs focused on reducing environmental impact.</li><li>
<strong>Career growth:</strong>Develop specialized incident response expertise while contributing to the continuous improvement of cybersecurity services and investigative practices.</li><li>
<strong>Compensation and insurance:</strong>Specific salary ranges, insurance coverage, and additional financial benefits were not detailed in the provided job description.</li>