Senior Incident Response Analyst

Accountabilities • Lead incident investigations: Investigate, analyze, and respond to active cybersecurity incidents using available security technologies and investigative methodologies to identify threats and disrupt malicious activity.

• Contain and remediate cyber threats: Identify initial access methods, persistence mechanisms, lateral movement, and other adversary behaviors, providing actionable recommendations to contain attacks, neutralize threats, and support remediation.

• Analyze malware and ransomware: Conduct in-depth investigations into ransomware, malware, and other common cyberattack types to determine their scope, impact, and associated indicators of compromise.

• Support MDR customers and service providers: Work directly with customers and managed service providers through calls and meetings to explain incident findings, communicate response priorities, and provide clear technical guidance throughout investigations.

• Perform endpoint and network investigations: Analyze security events across Windows, Linux, and macOS environments, investigating network activity, endpoint telemetry, and relevant security alerts to determine the extent of compromise.

• Mentor and guide analysts: Provide technical guidance, investigation reviews, and escalation support to incident response analysts and MDR operations teams, helping strengthen investigative quality and response effectiveness.

• Collaborate with security specialists: Partner with threat intelligence, detection engineering, threat hunting, and MDR operations teams to improve detection logic, share investigative findings, and enhance organizational response capabilities.

• Maintain detailed investigation records: Document investigative procedures, evidence, findings, indicators of compromise, and response actions accurately to support transparency, reproducibility, and effective incident management.

• Prepare technical incident reports: Produce comprehensive post-incident reports for customers and service providers, outlining the attack timeline, investigation results, impact, and recommended remediation measures.

• Apply recognized threat frameworks: Use established cybersecurity frameworks and adversary behavior models to structure investigations, understand attack progression, and communicate findings consistently.

• Improve incident response capabilities: Evaluate emerging technologies, tools, and processes to identify opportunities to improve investigation efficiency, response quality, and threat containment.

• Contribute to threat research and knowledge sharing: Where appropriate, share technical insights through articles, blogs, social media, and other professional channels covering adversary tactics, techniques, procedures, and investigative findings.

• Maintain high-quality customer service: Communicate clearly and professionally during high-pressure incidents, helping customers understand risks, prioritize actions, and make informed decisions.

• Provide flexible incident coverage: Support incident response operations during occasional weekends and holidays when required to address urgent cybersecurity events.

Requirements

• Relevant cybersecurity experience: At least 4 years of experience conducting structured cybersecurity investigations or at least 2 years of direct experience handling incident response engagements.

• Network and IT infrastructure knowledge: Strong understanding of network architecture, IT infrastructure, network communications, and the security principles needed to investigate complex cyber incidents.

• Endpoint and network investigation skills: Hands-on experience investigating Windows, Linux, and macOS environments, with knowledge of intrusion detection and prevention systems (IDS/IPS), endpoint detection and response (EDR), and basic malware analysis.

• Incident response expertise: Ability to investigate security incidents methodically, identify attack vectors and adversary activity, assess incident scope, and recommend effective containment and remediation measures.

• Threat analysis and investigative frameworks: Experience applying frameworks such as MITRE ATT&CK and the Cyber Kill Chain to understand attack techniques, structure investigations, and support incident reporting.

• Querying and investigative tools: Working knowledge of at least one of the following: osquery, SQL, or Kusto Query Language (KQL).

• Operating system and scripting knowledge: Familiarity with Windows and Linux command-line environments and scripting interpreters to support investigations, evidence collection, and technical analysis.

• Technical reporting and documentation: Demonstrated ability to produce accurate, detailed technical documentation and customer-facing incident reports that clearly explain findings and recommended actions.

• Customer communication: Strong verbal and written communication skills, with the ability to discuss complex security incidents, explain technical findings, and provide practical recommendations to customers and service providers.

• Performance under pressure: Ability to make sound, context-driven decisions during time-sensitive security incidents while maintaining investigative accuracy and prioritizing actions that disrupt adversary activity.

• Teamwork and mentoring: Ability to collaborate effectively with multidisciplinary security teams, provide constructive technical guidance, review investigative work, and support the development of other analysts.

• Adaptability and availability: Willingness to work occasional weekends and holidays and respond effectively to urgent incidents in a fast-paced security operations environment.

• Preferred certifications: Advanced cybersecurity certifications such as GIAC Certified Forensic Examiner (GCFE), GIAC Certified Forensic Analyst (GCFA), CompTIA Cybersecurity Analyst (CySA+), or Offensive Security Certified Professional (OSCP) are advantageous.

• Additional preferred experience: Previous experience providing customer-facing incident response services, handling customer calls, or delivering technical security guidance is beneficial.

• Industry contributions: Published cybersecurity research, articles, technical content, or acknowledged contributions to the cybersecurity community are an advantage.

• Remote working readiness: Ability to work independently and collaborate effectively with distributed teams. Applicants must be legally authorized to work in India without requiring employer sponsorship.

Benefits

• Remote-first working model: Work remotely from India, with flexibility suited to a distributed global team.

• Professional development: Opportunities to deepen expertise in incident response, digital forensics, threat intelligence, malware analysis, and advanced security operations.

• Collaborative technical environment: Work alongside experienced cybersecurity specialists across incident response, detection engineering, threat hunting, and MDR operations.

• Continuous learning: Access to wellbeing webinars, training opportunities, and knowledge-sharing initiatives that support professional and personal development.

• Employee wellbeing: Participate in global wellbeing days designed to help employees relax, recharge, and maintain a healthy work-life balance.

• Fitness and engagement initiatives: Take part in global fitness challenges, trivia competitions, and other employee engagement activities.

• Inclusive workplace culture: Join an environment that values diverse perspectives, equal opportunity, collaboration, and mutual respect.

• Employee-led communities: Opportunities to participate in diversity and inclusion networks that promote education, advocacy, and community building.

• Community involvement: Participate in charitable initiatives, fundraising activities, and volunteer days supporting local communities.

• Sustainability initiatives: Contribute to global employee programs focused on reducing environmental impact.

• Career growth: Develop specialized incident response expertise while contributing to the continuous improvement of cybersecurity services and investigative practices.

• Compensation and insurance: Specific salary ranges, insurance coverage, and additional financial benefits were not detailed in the provided job description.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1