Why Mizuho At Mizuho, we provide the stability of an international industry leader with the career trajectory of a growing business. Our steady, strategic growth gives our people at all levels rewarding degrees of responsibility and richer work experience than a boutique firm or an established giant could offer alone. It’s the local expertise of our employees that makes our global network so powerful. By collaborating with colleagues and clients who share the same ambition and drive, you can amplify your sphere of influence and base of knowledge as part of one of the largest banks in the world. Profile Summary: The Incident Response Analyst is a key member of the Cyber Security Incident Response function, responsible for detecting, triaging, investigating, containing and coordinating the resolution of cyber security incidents across Mizuho EMEA. The role combines security monitoring, incident handling, threat hunting and digital forensics to reduce business impact, preserve evidence and improve organizational resilience. The job holder will work with technology, business, risk, legal, compliance and third-party stakeholders throughout the incident lifecycle. The role will also contribute to playbooks, detection engineering, threat intelligence integration, post-incident reviews and management reporting. Duties and

Responsibilities:
Incident Detection, Triage and Response:
• Monitor and analyze alerts from SIEM, EDR/XDR, identity, email, cloud, network and other security controls to identify suspicious or malicious activity.
• Triage alerts, validate incidents, determine severity and business impact, and escalate in line with the incident response process and defined service levels.
• Lead or support investigations into internal and external threats, including phishing, malware, account compromise, data loss, unauthorized access and suspicious network activity.
• Coordinate containment, eradication and recovery activities with infrastructure, application, identity, cloud and business teams, maintaining clear ownership and decision records.
• Maintain accurate incident case records, investigation timelines, evidence, actions, decisions and closure rationale from initial detection through to resolution.
• Provide timely incident updates and concise technical and management reports, including material facts, impact, risk, actions, dependencies and next steps. Digital Forensics and Investigation:
• Collect, preserve and analyze endpoint, server, identity, network, email and cloud artefacts in accordance with approved forensic and evidence-handling procedures.
• Perform host and network analysis using logs, packet captures, forensic images and security telemetry to establish scope, root cause, attacker activity and affected assets.
• Identify indicators of compromise, tactics, techniques and procedures, and map findings to MITRE ATT&CK; where appropriate.




• Support legally or regulatorily sensitive investigations by maintaining evidence integrity, chain of custody and appropriate access controls.
• Engage specialist internal or external forensic support where the complexity, scale or sensitivity of an incident requires additional expertise. Threat Hunting and Detection Improvement:
• Develop and execute hypothesis-led threat hunts using threat intelligence, environmental knowledge and observed attacker behaviors.
• Create, tune and validate monitoring use cases, correlation rules, queries, custom indicators and detection content to improve coverage and reduce false positives.
• Assess detection gaps identified during incidents and recommend enhancements to logging, telemetry, processes and security controls.
• Contribute to purple-team, penetration-testing and control-validation activities and ensure relevant findings are converted into actionable detection or response improvements. Incident Response Capability and Governance:
• Develop, maintain and exercise incident response plans, standard operating procedures, playbooks, call-out arrangements and stakeholder communication templates.
• Conduct post-incident reviews and root-cause analysis, track lessons learned and ensure agreed corrective actions are assigned and monitored to closure.
• Contribute to incident response metrics, key risk indicators, trend analysis and control-effectiveness reporting for management and governance forums.
• Support cyber exercises and simulations to validate roles, escalation paths, communications and decision-making under realistic incident conditions.
• Keep current with emerging threats, vulnerabilities, attack methods and changes to relevant industry frameworks and regulatory expectations. Skills and

Experience:
Essential:
• Practical experience in cyber incident response, security monitoring or a Security Operations Centre environment.
• Hands-on experience investigating security alerts and incidents using SIEM and EDR/XDR technologies.
• Experience analyzing Windows and Linux host artefacts, authentication activity, security logs, network traffic and packet captures.
• Working knowledge of incident response lifecycle activities including preparation, detection, analysis, containment, eradication, recovery and lessons learned.
• Experience producing incident records, investigation reports, management updates and post-incident findings.
• Understanding of attacker behaviors and frameworks including MITRE ATT&CK;, Cyber Kill Chain and NIST incident response guidance.




• Knowledge of enterprise networking, identity and access management, cloud services, email security, endpoint security, vulnerability management and data loss prevention.
• Ability to manage multiple priorities, exercise sound judgement under pressure and communicate clearly with technical and senior stakeholders.
• Awareness of evidence handling, forensic integrity, confidentiality and regulatory considerations relevant to cyber investigations. Desirable:
• Experience in banking, financial services or another regulated environment.
• Experience with threat intelligence, malware analysis, scripting or automation using PowerShell, Python, KQL or similar languages.
• Experience developing detection rules, response playbooks, threat hunts or security orchestration and automation workflows.
• Knowledge of Microsoft security technologies such as Sentinel, Defender XDR, Defender for Identity and Defender for Cloud, or equivalent platforms.
• Exposure to forensic tools such as EnCase, FTK, Velociraptor, Volatility, Wireshark or equivalent.
• Understanding of cloud investigation techniques across Microsoft Azure, Microsoft 365 or other major cloud platforms.

Qualifications:
• Relevant professional experience supported by a degree in cyber security, computer science or a related discipline, or equivalent practical experience.
• One or more relevant certifications such as GCIH, GCIA, GCFA, GNFA, SC-200, CySA+, CISSP or equivalent are desirable.
• Sound knowledge of information security principles, recognised standards and regulatory expectations, including NIST, CIS Controls and relevant privacy requirements. Company Overview: Mizuho Pune is an integral part of Mizuho Financial Group, one of the world’s leading financial institutions with a strong global presence across the Americas, EMEA, and Asia. Based in India, Mizuho Pune supports Mizuho’s international businesses by delivering high-quality, scalable, and resilient services across multiple functions. Mizuho Pune plays a critical role in driving operational excellence, standardization, and innovation for Mizuho Americas. By combining deep domain expertise with strong process, technology, and analytical capabilities, it partners closely with regional and global teams to support corporate and investment banking, capital markets, and corporate services functions, while adhering to the highest standards of risk management, regulatory compliance, and control. Mizuho Pune offers competitive compensation and advantages package aligned with industry standards and local market practices. Mizuho Pune is an equal opportunity employer and is committed to fostering an inclusive and diverse workplace. Employment is subject to applicable background verification checks in accordance with Indian laws and company policies. https://www.mizuhogroup.com/asia-pacific/mizuho-global-services/careers

📌 Cyber Incident Response Analyst (Pune)
🏢 Mizuho
📍 Pune