Senior Security Consultant

Job Description – Senior Cybersecurity Incident Response Specialist

Experience: 8–10 Years

Function: Cybersecurity – Incident Response / DFIR

Role Level: Senior

Role Overview

We are looking for an experienced Cybersecurity Incident Response Specialist with 8–10 years of hands-on cybersecurity experience to manage and investigate security incidents across enterprise environments.

The candidate will be responsible for end-to-end ownership of cybersecurity incidents, including triage, investigation, containment, eradication, recovery, Root Cause Analysis (RCA), malware analysis, and digital forensic analysis. The role also requires strong customer-facing skills to lead incident discussions, provide regular updates, explain technical findings, and present investigation outcomes and recommendations.

Key Responsibilities

Incident Response & Investigation

- Take end-to-end ownership of cybersecurity incidents from initial detection through closure.

- Lead investigation of Critical, High, and complex security incidents and coordinate response activities across relevant teams.

- Perform incident triage, scoping, containment, eradication, recovery, and post-incident analysis.

- Investigate incidents involving ransomware, malware, phishing, account compromise, credential theft, data exfiltration, insider threats, web attacks, lateral movement, privilege escalation, and other advanced threats.

- Analyze security alerts and correlate information across EDR, SIEM, network, identity, cloud, email, and other security technologies.

- Develop incident timelines and determine the attack vector, affected assets, compromised accounts, attacker activity, persistence mechanisms, and overall impact.

- Identify Indicators of Compromise (IOCs), attacker Tactics, Techniques, and Procedures (TTPs), and map findings to the MITRE ATT&CK framework.

- Coordinate with SOC, Threat Hunting, Threat Intelligence, IT, Cloud, Network, IAM, Application, Legal, and other stakeholders during major incidents.

Root Cause Analysis (RCA)

- Perform detailed Root Cause Analysis for security incidents.

- Determine the initial attack vector, contributing factors, security/control gaps, and reasons existing preventive or detective controls did not stop or detect the activity earlier.

- Conduct post-incident reviews and lessons-learned sessions.

- Develop clear corrective and preventive actions based on investigation findings.

- Track remediation recommendations with relevant stakeholders through closure.

- Prepare comprehensive RCA reports suitable for technical teams, management, and customers.

Malware Analysis

- Perform static and dynamic malware analysis to understand malicious file behavior and capabilities.

- Analyze suspicious executables, scripts, PowerShell commands, documents, URLs, and other artifacts.

- Identify malware persistence mechanisms, command-and-control activity, network indicators, file-system changes, registry modifications, and related behaviors.

- Extract IOCs and behavioral indicators for threat hunting and detection engineering.

- Perform malware sandboxing and behavioral analysis where required.

- Provide recommendations for detection, containment, and prevention based on malware-analysis findings.

Digital Forensics

- Perform digital forensic investigations on endpoints and other relevant systems.

- Analyze Windows/Linux artifacts, event logs, file systems, registry artifacts, browser artifacts, authentication logs, memory artifacts, and other forensic evidence.

- Perform disk and memory analysis where required.

- Collect and preserve digital evidence following appropriate forensic procedures and chain-of-custody requirements.

- Build forensic timelines and reconstruct attacker activities.

- Determine the scope and impact of compromise using forensic evidence.

- Document forensic findings clearly and maintain investigation evidence appropriately.

Customer & Stakeholder Management

- Act as a key technical point of contact for customers during cybersecurity incidents.

- Lead incident calls and communicate investigation progress, impact, containment status, risks, and next steps.

- Provide timely and accurate incident updates to customers and internal leadership.

- Translate complex technical investigation findings into clear business-level communication.

- Manage customer expectations during high-severity and time-sensitive incidents.

- Present RCA and forensic investigation findings to customers and senior stakeholders.

- Handle technical questions and confidently explain investigation methodology, evidence, conclusions, and recommendations.

- Coordinate with multiple internal and customer teams to drive incidents toward timely resolution.

Incident Reporting & Documentation

- Prepare detailed incident investigation reports, including:

- Maintain accurate incident records, evidence, investigation notes, and supporting documentation.

- Contribute to the development and improvement of Incident Response playbooks, SOPs, investigation procedures, and escalation processes.

- Executive summary

- Incident timeline

- Scope and impact

- Root cause

- Attack vector

- IOCs and TTPs

- Investigation findings

- Containment and remediation actions

- Control gaps

- Corrective and preventive recommendations

- Lessons learned

Required Technical Skills

The candidate should have strong hands-on experience in:

- Cybersecurity Incident Response / DFIR

- Security Incident Investigation

- Root Cause Analysis (RCA)

- Digital Forensics

- Malware Analysis

- Threat Hunting

- Endpoint and Network Investigation

- Windows and Linux Forensics

- Disk and Memory Analysis

- Log Analysis and Timeline Reconstruction

- IOC and TTP Analysis

- MITRE ATT&CK Framework

- SIEM platforms such as Splunk, Microsoft Sentinel, QRadar, or similar

- EDR/XDR platforms such as CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, Cortex XDR, or similar

- Network security technologies including Firewall, IDS/IPS, Proxy, DNS, VPN, and WAF

- Cloud security investigation across AWS, Azure, and/or GCP environments

- Identity and authentication-related investigations

- Email and phishing investigations

- Forensic and malware-analysis tools such as Volatility, Autopsy, FTK, EnCase, Wireshark, Sysinternals, YARA, Ghidra, IDA, or equivalent tools

- Scripting/automation using Python, PowerShell, or similar technologies would be an advantage.

Required Experience

- 8–10 years of overall cybersecurity experience, with significant hands-on experience in Incident Response, DFIR, SOC, Threat Hunting, or related security domains.

- Demonstrated experience independently handling complex and high-severity cybersecurity incidents.

- Strong experience conducting RCA and presenting investigation findings.

- Hands-on experience with malware and forensic investigations.

- Experience handling customer-facing security incidents and leading technical/customer incident calls.

- Experience coordinating investigations involving multiple technical and business teams.

- Ability to work effectively under pressure during Critical/High-severity incidents.

- Strong analytical, troubleshooting, and problem-solving skills.

Communication & Leadership Skills

- Excellent verbal and written communication skills.

- Strong customer-facing and stakeholder-management capabilities.

- Ability to communicate effectively with both technical and non-technical stakeholders.

- Ability to lead incident bridges/calls during critical incidents.

- Strong documentation and report-writing skills.

- Ability to take ownership, make investigation decisions, and drive incidents to closure.

- Ability to mentor junior Incident Response/SOC analysts and provide technical guidance during investigations.