AD-DFIR

Mitigata™ - Full-Stack Cyber Resilience; Bengaluru; On-site; INR 3,500,000 - 7,000,000; Full time

Job summary

Mitigata™ - Full-Stack Cyber Resilience in Bengaluru seeks an Associate Director for Digital Forensics & Incident Response to lead crisis responses for enterprise clients. You will oversee high-stakes breach investigations, steer technical forensic analyses, and mentor incident responders.

You will partner with executive leadership, legal counsel, and insurers to provide RCA packs, evidence preservation, and regulatory compliance across on-premises and cloud environments.

Qualifications

• 10+ years in Digital Forensics, Incident Response, or SOC leadership.
• 4+ years in direct team management or practice delivery.

Responsibilities

• Lead full lifecycle incident response for critical security breaches.
• Oversee forensic investigations across Windows, Linux, macOS, cloud, and apps.
• Coordinate RCA, IOCs, and audit-grade reports for stakeholders and insurers.

Skills

Digital Forensics

Incident Response

SOC leadership

EDR/XDR tools

SIEM

Cloud forensics

Regulatory compliance

Education

Bachelor's or Master's in CS/Cyber Security

Tools

FTK

EnCase

Volatility

X-Ways

SANS SIFT

CrowdStrike

SentinelOne

Defender for Endpoint

Job description

About MitigataMitigata is India’s full-stack cyber resilience platform. We combine IRDAI-licensed cyber insurance, proactive security services, and real-time compliance automation into a unified model. When cyber crisis hits—ranging from ransomware exfiltration to complex credential breaches—our dedicated teams deliver end-to-end incident response, digital forensics, claim management, and post-breach recovery for 800+ enterprise clients.

About the Role

Role SummaryAs the Associate Director – Digital Forensics & Incident Response (AD - DFIR), you will lead Mitigata’s crisis response practice. You will oversee high-stakes breach investigations, manage technical forensic analysis, coordinate root-cause reconstructions for cyber insurance claims, and mentor a team of incident response specialists. You will act as the principal authority during client cyber emergencies, advising executive leadership, legal counsel, and insurers.

Responsibilities

• Experience Level: 10–12+ Years
• Department: Incident Response & Security Delivery

Key Responsibilities

• 1. Incident Response & Forensics OperationsDirect full lifecycle handling of critical security incidents, including ransomware, data exfiltration, business email compromise (BEC), APT campaigns, and cloud environments.
• Lead deep-dive forensic investigations across Windows, Linux, macOS, cloud infrastructure (AWS/Azure/GCP), and enterprise applications.
• Reconstruct detailed incident timelines using SIEM logs, EDR telemetry, memory dumps, disk images, and network traffic captures.
• Prepare audit-grade forensic reports, threat intelligence indicators (IOCs), and root-cause analysis (RCA) packs for internal stakeholders, client executive boards, legal teams, and insurance underwriters.
• 2. Practice Leadership & Team ManagementLead, mentor, and expand Mitigata’s DFIR engineering and threat hunting pods.
• Define technical IR playbooks, containment procedures, evidence preservation standards, and forensic toolchains.
• Oversee quality assurance for all delivery reports, ensuring strict adherence to chain of custody, legal admissibility, and regulatory standards.
• 3. Cyber Insurance & Ecosystem CoordinationCollaborate directly with Mitigata’s Claims and Incident Response Managers (IRMs) to support technical assessments for cyber insurance coverage.
• Interface with external stakeholders during breach response—including privacy regulatory bodies (e.g., CERT-In, DPDP framework), legal counsel, PR firms, and loss assessors.

Qualifications

• Education: Bachelor's or Master's degree in Computer Science, Cyber Security, Information Technology, or related engineering discipline.

Required Skills

• Required Experience & QualificationsExperience: 10+ years in Digital Forensics, Incident Response, or SOC leadership, with 4+ years in direct team management or practice delivery.
• Core Technical Skills:Advanced disk/memory forensics (FTK, EnCase, Volatility, X-Ways, SANS SIFT).
• Hands-on triage using EDR/XDR suites (CrowdStrike, SentinelOne, Defender for Endpoint) and SIEM solutions.
• Malware analysis basics (static/dynamic behavior triage) and reverse-engineering concepts.
• Experience handling cloud breach investigations (AWS, Azure, Microsoft 365 logs).
• Regulatory Knowledge: Deep understanding of evidence collection guidelines, Indian IT Act, CERT-In compliance mandates, and DPDP Act '23.

Preferred Skills

• Preferred CertificationsForensics & IR: GIAC Certified Forensic Analyst (GCFA), GIAC Certified Incident Handler (GCIH), GNFA, or GREM.
• Security & Infrastructure: CISSP, CISM, CREST Certified Incident Manager, or OSCP.