Incident Responder - Incident, Incidents, Responder, Response, Responses, SIEM, EDR, XDR - Mumbai, 4.00 - 6.00 yrs | Sampoorna (J50990)

Job Location: Thane

Key Responsibilities
• Lead end-to-end incident response activities, including triage, investigation, containment, eradication, and recovery for security incidents across endpoint, network, identity, and cloud environments.
• Perform deep-dive investigations by correlating logs and telemetry from multiple sources such as SIEM, EDR/XDR, email security, and cloud platforms to identify root cause, attack vectors, and scope of compromise.
• Conduct proactive threat hunting using hypothesis-driven and intelligence-led approaches to identify hidden or emerging threats that may have bypassed existing controls.
• Analyze and map attacker behavior using frameworks like MITRE ATT&CK, identifying tactics, techniques, and procedures (TTPs) to strengthen detection and response capabilities.
• Develop and execute incident response playbooks and runbooks, ensuring consistent, efficient, and scalable response to recurring attack scenarios.
• Collaborate closely with SOC analysts, threat intelligence teams, and engineering teams to enrich investigations, validate findings, and improve detection use cases.
• Drive rapid containment and remediation actions, including isolating affected systems, blocking malicious indicators, and coordinating with IT teams for patching and recovery.
• Perform forensic analysis (disk, memory, log analysis where required) to support detailed investigations and provide actionable insights.
• Continuously tune and enhance detection rules, correlation logic, and alert fidelity within SIEM/XDR platforms to reduce false positives and improve threat visibility.
• Prepare clear, concise, and executive-level incident reports, including timelines, impact assessment, root cause, and recommended preventive measures.
• Support post-incident reviews and lessons learned sessions, contributing to improving overall security posture and response maturity.
• Stay updated with the latest threat landscape, attacker techniques, and vulnerabilities, and proactively recommend improvements to security controls and monitoring strategies.

Required Skills & Experience
• 4–5 years of hands-on and relevant experience in Cybersecurity Operations, with a strong focus on Incident Response, Threat Hunting, and Security Investigations.
• Proven experience in handling end-to-end incident response lifecycle, including triage, analysis, containment, eradication, and recovery.
• Strong practical exposure to SIEM and EDR/XDR platforms (e.g., Securonix, Microsoft Defender, CrowdStrike, Stellar Cyber or similar) for investigation and response.
• Experience in analyzing logs and telemetry across endpoints, network devices, identity systems (Active Directory/Azure AD), and cloud environments (Azure/AWS/GCP).
• Demonstrated ability to conduct deep forensic investigations, including log analysis, process analysis, and basic memory/disk forensics.
• Hands-on experience in threat hunting, using hypothesis-driven approaches and leveraging threat intelligence to identify stealthy or persistent threats.
• Strong understanding of attacker tactics, techniques, and procedures (TTPs) and practical application of frameworks like MITRE ATT&CK.
• Experience in handling common attack scenarios such as phishing, ransomware, lateral movement, privilege escalation, and account compromise.
• Familiarity with email security, endpoint protection, identity security, and cloud security controls.
• Ability to write and tune detection rules/use cases to improve alert quality and reduce false positives.
• Experience in working within a SOC or MSSP environment, handling multiple clients or large-scale enterprise environments is preferred.
• Strong analytical, problem-solving, and communication skills, with the ability to create clear investigation reports and incident summaries.