Role summary

You will own the response to serious security incidents across hybrid healthcare and pharma environments, from first containment through forensics, root cause and regulatory reporting. You will also shape what the SOC detects, so every incident turns into better detections. The two responders share detection strategy and DFIR and cover each other across shifts.

Key responsibilities

Incident response

- Lead response to high-severity incidents: ransomware, business email compromise, identity compromise, insider misuse, data exfiltration and cloud account takeover.

- Run containment and eradication using CrowdStrike Falcon (Real Time Response, network containment, Falcon Fusion SOAR workflows) and Entra ID / Azure controls.

- Act as incident commander when needed, coordinating IT, application owners, legal, privacy and business leaders, and external DFIR retainers.

- Support breach assessment and regulatory notification, including CERT-In reporting timelines and DPDP Act obligations for patient and personal data.

Digital forensics

- Perform host forensics (Windows, Linux), memory analysis and timeline reconstruction using tools such as Falcon Forensics, Velociraptor, KAPE and Volatility.

- Investigate identity and cloud attacks using Entra ID sign-in and audit logs, Azure Activity logs and M365 unified audit logs.

- Preserve evidence with proper chain of custody for legal and regulatory use.

- Perform triage-level malware analysis (static and dynamic) and extract IOCs and TTPs.

Detection strategy

- Turn incident findings into new or tuned detections in Falcon Next-Gen SIEM, mapped to MITRE ATT&CK.;

- Lead hypothesis-driven threat hunts on healthcare-relevant threats:



ransomware groups, identity attacks, attacks on clinical and R&D; systems.

- Own IR playbooks and runbooks; run tabletop exercises with technical and leadership teams.

- Write post-incident reports with root cause, impact and remediation, and track actions to closure.

Leadership

- Mentor L2 analysts on investigation depth and forensic technique.

- Serve as the top escalation point on shift and during on-call.

Must-have skills

- 10+ years in security, with deep hands-on incident response leading real-world, high-severity incidents.

- Strong CrowdStrike Falcon experience (Insight XDR, RTR, Next-Gen SIEM / LogScale query language).

- Windows internals and Active Directory attacks (Kerberoasting, DCSync, pass-the-hash, golden tickets) and their forensic artefacts.

- Entra ID and Azure attack investigation: token theft, consent phishing, MFA fatigue, cloud privilege escalation.

- Memory and disk forensics, log analysis and timeline building.

- Clear communication with technical teams and executives under pressure.

Positive to have

- Incident experience in healthcare, pharma or other regulated sectors.

- Container and Kubernetes (AKS) incident investigation.

- Scripting in Python or PowerShell for triage and automation.

- Certifications: GCFA, GCIH, GNFA, GREM, CrowdStrike CCFR/CCFH, or equivalent.

- Looking for Immediate Joiners

What success looks like in 12 months

- Mean time to contain high-severity incidents measurably reduced.

- IR playbooks for the top 10 incident types written, tested and in use.

- At least two tabletop exercises run, including one with leadership.

- Every major incident closed with a post-incident review and new detections.

📌 Senior Incident Responder - Detection & DFIR (Bengaluru)
🏢 Neurealm
📍 Bengaluru