Bengaluru, Karnataka

Forensic Focus; Bengaluru; On-site; INR 6,000,000 - 10,000,000; Full time

Job summary

Forensic Focus in Bengaluru is seeking a Lead/Principal DFIR to direct the full lifecycle of major security incidents, including ransomware, data exfiltration and cloud breaches. You will oversee investigations across endpoints, servers and cloud, reconstruct timelines, and deliver detailed forensic reports for executives, legal teams and insurers.

The role requires 10+ years in digital forensics, incident response or SOC leadership, with expertise in FTK, EnCase, Volatility and X-Ways, and

Qualifications

• 10+ years in digital forensics, incident response or SOC leadership.
• Hands-on experience with disk and memory forensics tools.
• Experience guiding forensic investigations across endpoints, servers and cloud.

Responsibilities

• Oversee full lifecycle of major security incidents, from detection to resolution.
• Lead forensic investigations across endpoints, servers and cloud platforms.
• Reconstruct incident timelines and produce detailed reports for executives, legal teams and insurers.
• Coordinate with legal and insurance stakeholders during crises.

Skills

Digital forensics

Incident response

SOC leadership

Team management

Client-facing advisory

Cloud forensics

EDR/SIEM

Malware triage

Regulatory knowledge

Executive reporting

Education

GCFA

GCIH

OSCP

Tools

FTK

EnCase

Volatility

X-Ways

Job description

# AD-DFIR*MitigataTM - Full-Stack Cyber Resilience***Bengaluru, Karnataka**Onsite · Lead/Principal · Full-time### The RoleThis leadership position oversees the full lifecycle of major security incidents, from ransomware and data exfiltration to cloud breaches. It involves directing forensic investigations across endpoints, servers and cloud platforms, reconstructing incident timelines, and producing detailed forensic reports for executives, legal teams and insurers.### Skills & ExperienceCandidates need 10+ years in digital forensics, incident response or SOC leadership, including team management experience. Expertise spans disk and memory forensics tools (FTK, EnCase, Volatility, X-Ways), EDR/SIEM platforms, malware triage, cloud breach handling, and regulatory frameworks like CERT-In and DPDP. Certifications such as GCFA, GCIH or OSCP are preferred.### Who It SuitsIdeal for an experienced DFIR practitioner ready to step into a senior leadership role, combining hands-on forensic expertise with team mentorship, client-facing advisory work, and coordination with legal and insurance stakeholders during crises.