Job Location : Thane

Key Responsibilities :

- Lead end-to-end incident response activities, including triage, investigation, containment, eradication, and recovery for security incidents across endpoint, network, identity, and cloud environments.
- Perform deep-dive investigations by correlating logs and telemetry from multiple sources such as SIEM, EDR/XDR, email security, and cloud platforms to identify root cause, attack vectors, and scope of compromise.
- Conduct proactive threat hunting using hypothesis-driven and intelligence-led approaches to identify hidden or emerging threats that may have bypassed existing controls.
- Analyze and map attacker behavior using frameworks like MITRE ATT&CK;, identifying tactics, techniques, and procedures (TTPs) to strengthen detection and response capabilities.
- Develop and execute incident response playbooks and runbooks, ensuring consistent, efficient, and scalable response to recurring attack scenarios.
- Collaborate closely with SOC analysts, threat intelligence teams, and engineering teams to enrich investigations, validate findings, and improve detection use cases.
- Drive rapid containment and remediation actions, including isolating affected systems, blocking malicious indicators, and coordinating with IT teams for patching and recovery.
- Perform forensic analysis (disk, memory, log analysis where required) to support detailed investigations and provide actionable insights.
- Continuously tune and enhance detection rules, correlation logic, and alert fidelity within SIEM/XDR platforms to reduce false positives and improve threat visibility.
- Prepare clear, concise, and executive-level incident reports, including timelines, impact assessment, root cause, and recommended preventive measures.
- Support post-incident reviews and lessons learned sessions, contributing to improving overall security posture and response maturity.




- Stay updated with the latest threat landscape, attacker techniques, and vulnerabilities, and proactively recommend improvements to security controls and monitoring strategies.

Required Skills &

Experience :

- 4 - 5 years of hands-on and relevant experience in Cybersecurity Operations, with a robust focus on Incident Response, Threat Hunting, and Security Investigations.
- Proven experience in handling end-to-end incident response lifecycle, including triage, analysis, containment, eradication, and recovery.
- Strong practical exposure to SIEM and EDR/XDR platforms (e.g., Securonix, Microsoft Defender, CrowdStrike, Stellar Cyber or similar) for investigation and response.
- Experience in analyzing logs and telemetry across endpoints, network devices, identity systems (Active Directory/Azure AD), and cloud environments (Azure/AWS/GCP).
- Demonstrated ability to conduct deep forensic investigations, including log analysis, process analysis, and basic memory/disk forensics.
- Hands-on experience in threat hunting, using hypothesis-driven approaches and leveraging threat intelligence to identify stealthy or persistent threats.
- Strong understanding of attacker tactics, techniques, and procedures (TTPs) and practical application of frameworks like MITRE ATT&CK.;
- Experience in handling common attack scenarios such as phishing, ransomware, lateral movement, privilege escalation, and account compromise.
- Familiarity with email security, endpoint protection, identity security, and cloud security controls.
- Ability to write and tune detection rules/use cases to improve alert quality and reduce false positives.
- Experience in working within a SOC or MSSP environment, handling multiple clients or large-scale enterprise environments is preferred.
- Strong analytical, problem-solving, and communication skills, with the ability to create clear investigation reports and incident summaries.

📌 Incident Responder - Cyber Security (India)
🏢 Sampoorna Computer People
📍 India