Job Location:

Thane

Key Responsibilities:

- Lead end-to-end incident response activities, including triage, investigation, containment, eradication, and recovery for security incidents across endpoint, network, identity, and cloud environments.

- Perform deep-dive investigations by correlating logs and telemetry from multiple sources such as SIEM, EDR/XDR, email security, and cloud platforms to identify root cause, attack vectors, and scope of compromise.

- Conduct proactive threat hunting using hypothesis-driven and intelligence-led approaches to identify hidden or emerging threats that may have bypassed existing controls.

- Analyze and map attacker behavior using frameworks like MITRE ATT&CK, identifying tactics, techniques, and procedures (TTPs) to strengthen detection and response capabilities.

- Develop and execute incident response playbooks and runbooks, ensuring consistent, efficient, and scalable response to recurring attack scenarios.

- Collaborate closely with SOC analysts, threat intelligence teams, and engineering teams to enrich investigations, validate findings, and improve detection use cases.

- Drive rapid containment and remediation actions, including isolating affected systems, blocking malicious indicators, and coordinating with IT teams for patching and recovery.

- Perform forensic analysis (disk, memory, log analysis where required) to support detailed investigations and provide actionable insights.

- Continuously tune and enhance detection rules, correlation logic, and alert fidelity within SIEM/XDR platforms to reduce false positives and improve threat visibility.

- Prepare clear, concise, and executive-level incident reports, including timelines, impact assessment, root cause, and recommended preventive measures.

- Support post-incident reviews and lessons learned sessions, contributing to improving overall security posture and response maturity.

- Stay updated with the latest threat landscape, attacker techniques, and vulnerabilities, and proactively recommend improvements to security controls and monitoring strategies.

Required Skills & Experience:

- 4 - 5 years of hands-on and relevant experience in Cybersecurity Operations, with a strong focus on Incident Response, Threat Hunting, and Security Investigations.

- Proven experience in handling end-to-end incident response lifecycle, including triage, analysis, containment, eradication, and recovery.

- Strong practical exposure to SIEM and EDR/XDR platforms (e.g., Securonix, Microsoft Defender, CrowdStrike, Stellar Cyber or similar) for investigation and response.

- Experience in analyzing logs and telemetry across endpoints, network devices, identity systems (Active Directory/Azure AD), and cloud environments (Azure/AWS/GCP).

- Demonstrated ability to conduct deep forensic investigations, including log analysis, process analysis, and basic memory/disk forensics.

- Hands-on experience in threat hunting, using hypothesis-driven approaches and leveraging threat intelligence to identify stealthy or persistent threats.

- Strong understanding of attacker tactics, techniques, and procedures (TTPs) and practical application of frameworks like MITRE ATT&CK.

- Experience in handling common attack scenarios such as phishing, ransomware, lateral movement, privilege escalation, and account compromise.

- Familiarity with email security, endpoint protection, identity security, and cloud security controls.

- Ability to write and tune detection rules/use cases to improve alert quality and reduce false positives.

- Experience in working within a SOC or MSSP environment, handling multiple clients or large-scale enterprise environments is preferred.

- Strong analytical, problem-solving, and communication skills, with the ability to create clear investigation reports and incident summaries.