Desired Competencies (Technical/Behavioural Competency)

- Strong practical competency in Digital Forensics and Incident Response (DFIR) within enterprise cybersecurity environments

- Proven ability to perform security incident investigation, analysis, and response using:

- CrowdStrike Falcon platform (Falcon Complete) for endpoint-based detections, investigations, and response coordination

- Splunk Enterprise Security for SIEM-based alert analysis, correlation, and investigative workflows

- Solid understanding of endpoint forensic artifacts, particularly on Windows operating systems (mandatory)

- Solid skills in security log analysis, event correlation, and timeline reconstruction

- Ability to interpret EDR and SIEM alerts and translate them into actionable investigation outcomes.

- Knowledge of malware behaviour, attack techniques, lateral movement, and persistence mechanisms

- Hands-on experience supporting SOC operations, including incident triage, escalation, and containment support.

- Working knowledge of endpoint visibility and control platforms (such as Absolute Software) to support investigations and device intelligence

- Understanding of incident handling processes, evidence preservation, and chain of custody principles

Behavioural Competencies (Must Have) :

- Robust analytical and problem-solving skills with attention to detail during investigations
- Ability to work effectively under high-pressure and time-sensitive incident scenarios.
- Excellent communication skills, with the ability to explain technical findings to both technical and non-technical stakeholders.
- High level of ownership and accountability for investigation outcomes and deliverables




- Ability to collaborate closely with SOC, MDR, IR, and customer stakeholders.
- Strong documentation and reporting discipline, producing clear and structured investigation reports.
- Professional mindset with a strong focus on confidentiality, integrity, and ethical handling of sensitive data
- Willingness to continuously learn and adapt to evolving cyber threats and technologies.

Good-to-Have

- Experience with advanced threat hunting using EDR and SIEM platforms.

- Exposure to CrowdStrike Falcon advanced modules (e.g., threat intelligence, proactive hunting, or custom detections)

- Hands-on experience creating or tuning Splunk Enterprise Security correlation searches, dashboards, or notable events.

- Exposure to memory forensics, disk forensics, or network forensics tools and techniques

- Experience working with managed detection and response (MDR) teams or services.

- Familiarity with cloud security investigations (AWS, Azure, or GCP logs and alerts)

- Awareness of regulatory and compliance frameworks (ISO 27001, SOC 2, GDPR, etc.) from an investigation perspective

- Relevant cybersecurity or forensics certifications such as:

- GCFE, GCFA, GCIH, CHFI, CEH, or equivalent

- Prior experience in client-facing roles, consulting environments, or critical enterprise customers





- Scripting or automation exposure (PowerShell, Python, or similar) to support investigations or analysis.

- Willingness to participate in on-call or incident response rotations (as required)

Responsibility of / Expectations from the Role

- Perform hands on security incident investigation and response using industry standard, market available platforms
- Execute practical Digital Forensics activities on enterprise endpoints using
- Actively support Security Operations Center (SOC) functions.
- Leverage endpoint visibility and control platforms available in the market
- Analyze and correlate security events and logs from multiple sources including: EDR, SIEM, endpoint logs, server logs, and security tools.
- Identify root cause, attack vectors, and scope of compromise using real world investigation techniques and tooling.
- Maintain proper evidence handling, documentation, and chain of custody practices aligned with industry standards.
- Produce clear, actionable investigation reports, including timelines, findings, and remediation recommendations.
- Work closely with customer stakeholders, SOC teams, MDR providers, and internal security teams.
- Operate effectively in real incident scenarios, including high severity and time critical events.
- Participate in incident response/on call rotations as required by the engagement.

Location

- Ahmedabad

Job Function

- CONSULTANCY

Role

- Engineer

Job Id

- 396675

Desired Skills

- Splunk | Cyber Security | End Point Protection | SOC - Digital Forensics

Qualifications : BACHELOR OF ENGINEERING

📌 Digital Forensics & Incident Response (Dfir) Professional (Ahmedabad)
🏢 Tata Consultancy Services
📍 Ahmedabad