- Lead the response to cybersecurity incidents, including malware infections, data breaches, and insider threats.
- Perform real-time and retrospective analysis of security events to identify threats Coordinate with MSSP Security Operations Centre (SOC) teams for monitoring and alerting.
- Develop and document incident response plans and playbooks.
- Should be expertise on handling the incidents end to end.
- Conduct proactive threat hunting to identify unknown threats.
- Perform digital forensic analysis on compromised systems to determine root causes.
- Use forensic tools to collect and analyse logs, memory dumps, and disk images.
- Work with SIEM (Security Information and Event Management) tools to detect anomalous behaviour.
- Analyse logs from firewalls, intrusion detection/prevention systems (IDS/IPS), endpoint protection, and cloud security tools.
- Improve detection capabilities by tuning security alerts and developing new rules.
- Recommend and implement security controls to reduce exposure.
- Provide technical leadership to junior incident responders and security analysts
Requirements
- Strong expertise in incident response, threat hunting, and forensic analysis.
- Experience with SIEM tools (e.g., Elastic, Splunk).
- Proficiency in network security, malware analysis, and log analysis.
- Familiarity with cloud security (AWS, Azure, GCP) and container security.
- Experience with cloud security tools and AI-powered security analytics (AWS Guard Duty, Azure Sentinel, Google Chronicle).
- Familiarity with AI/ML-driven anomaly detection and behavioural analysis techniques.
- Knowledge of security solutions ( EDR,XDR,NDR,WAF,Proxy,Firewall,Email Security).
- Scripting and automation skills (Python, PowerShell, Bash).
- Deep understanding of MITRE ATT&CK framework, cyber kill chain, and machine learning models for cybersecurity applications.
- Excellent communication and report-writing skills and ability to work under pressure scenarios