Security Operator I

Position Overview: We are seeking an experienced Digital Forensics & IR Analyst to join our Cyber Defense capability, with a primary focus on Digital Forensics and Incident Response (DFIR). This role is responsible for conducting in-depth forensic investigations, evidence preservation, attack reconstruction, and root cause analysis, while supporting the SOC and Incident Response teams during complex and high severity incidents.

Key Responsibilities: Digital Forensics & Investigations

Run and execute forensic investigations involving endpoints, servers, network traffic, cloud platforms, and authentication systems

Perform forensic data acquisition and preservation, ensuring proper chain-of-custody and evidentiary integrity

Conduct timeline reconstruction, artifact analysis, and attack path analysis to determine scope, impact, and root cause

Analyze disk, memory, logs, and security telemetry to identify attacker techniques and dwell time

Support post incident‑ root cause analysis (RCA) and contribute to long term remediation recommendations

Incident Response & SOC Operations

Support incident response activities for security events including malware, phishing, endpoint compromise, suspicious access, and network based‑ attacks

Perform alert triage and investigation using SIEM and EDR platforms, escalating complex cases to senior IR or DFIR personnel

Execute incident response playbooks during active incidents, following defined investigation and escalation procedures

Perform deep dive log analysis across Windows, Linux, network, and cloud environments

Validate and enrich Indicators of Compromise (IOCs) using internal tools and threat intelligence sources

Correlate activity across SIEM, EDR, network, and authentication logs to identify scope and impact

Documentation & Reporting

Produce high quality forensic reports, investigation summaries, and executive level-incident documentation

Ensure investigations meet internal, regulatory, and audit requirements

Support legal, compliance, and regulatory teams by providing defensible forensic evidence when required

Maintain accurate incident and investigation documentation within the incident management system

Assist in preparing incident reports, forensic summaries, and lessons learned documentation

Ensure investigations meet internal quality, audit, and compliance expectations

Learning & Collaboration

Work closely with SOC analysts, Incident Responders, and senior DFIR engineers

Continuously build DFIR skills through hands-on investigations and training.

Stay current with attacker techniques, forensic methods, and SOC best practices

Required Skills & Experience

2+ years of hands-on experience in DFIR, Incident Response, and Security Investigations

Strong experience with Host, memory and network-based forensics.

Proficiency with SIEM and EDR platforms for investigation and correlation

Solid understanding of Windows, Linux, and networking.

Experience handling complex and high severity security incidents

Strong analytical and documentation skills with attention to evidentiary detail

Preferred Qualifications

• Hands-on experience with forensic tooling (disk, memory, log, or network analysis tools)

• Forensics Tools: Encase, FTK, X-Ways, Autopsy, Magnet Axiom, Nuix, Cellebrite etc.

• Malware Analysis Tools: DA Pro, Yara, volatility, Ghidra, etc.

• Familiarity with legal hold, eDiscovery, and regulatory response workflows

• Relevant certifications: GCFE, GCED, GCIH, GCIA, GNFA

• Key Competencies

• Analytical thinking: Ability to perform root cause analysis (RCA).

• Communication: Ability to communicate technical risks to stakeholders.

• Collaboration: Working with IT teams to improve security posture.

• Technical Environment:

• SIEM platforms

• EDR solutions

• Network monitoring tools

• Incident management systems

• Work Requirements:

• Willingness to work outside of standard working hours.

• Incident response handling

• Alert triage and escalation

• Documentation and reporting

• Team collaboration

• Growth Path:

• Advanced IR certification support

• Threat hunting training

• Technical skill development

• Senior analyst progression

• Company Benefits & Perks:

• Competitive salary package.

• Performance based annual bonus ( cash and stocks ).

• Hybrid working model (3 days office/week ).

• Group Medical & Life Insurance.

• Modern offices with free amenities & fully stocked cafeterias.

• Monthly food card & company paid snacks.

• Hardship/shift allowance with company provided pickup & drop facility*

• Attractive employee referral bonus.

• Frequent company sponsored team building events and outings.

• Depending upon the shifts.

• ** The benefits package is subject to change at the management's discretion.