Cyber Incident Responder (Incident Management)

Elfonze Technologies; Delhi; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Elfonze Technologies in Delhi NCR, India, seeks an experienced Cyber Incident Responder to contain and recover from security incidents swiftly, document actions taken, and perform RCA to prevent recurrence.

You will work with CrowdStrike XDR, SIEM, Fortinet proxies, WAF and DLP to coordinate containment, remediation, and reporting to SOC leadership and stakeholders.

Qualifications

• Bachelor's degree in CS/IT/Cybersecurity or related field.
• Hands-on incident containment and recovery experience.
• Experience documenting RCA and incident reports for leadership.

Responsibilities

• Contain and contain compromised hosts and networks to stop lateral movement.
• Lead remediation to remove malware, patch vulnerabilities and reset credentials.
• Develop RCA and incident reports with evidence-backed conclusions.
• Coordinate with IT, security and business teams and report to stakeholders.

Skills

Containment strategies

Incident response

Root cause analysis

Communication

MITRE ATT&CK familiarity

Education

Bachelor's degree in Computer Science, IT, Cybersecurity or related field

Tools

CrowdStrike Falcon XDR

Fortinet Proxy

Fortinet WAF

SIEM

Splunk

QRadar

Microsoft Sentinel

Job description

Delhi, NCR, India | Posted on 09/23/2026

JobSummary

Weare seeking an experienced Cyber Incident Responder whose primary mandate is tocontain and recover from security incidents swiftly and effectively, minimizingdamage, downtime, and business impact — followed by thorough Root CauseAnalysis (RCA) and Incident Reporting to prevent recurrence. Using CrowdStrikeXDR, SIEM, Forcepoint DLP, Fortinet Proxy, and Fortinet WAF, this role is thefront line of defence once a threat is confirmed, and the owner of documentingwhat happened, why, and how to stop it happening again.

KeyResponsibilities (In Priority Order)

1. Incident Containment (Primary Responsibility)

• Takeimmediate, decisive action to isolate compromised hosts, accounts, or networksegments to stop lateral movement and further damage.
• UseCrowdStrike XDR to isolate infected endpoints, kill malicious processes, andblock malicious hashes/IOCs in real time.
• Blockmalicious IPs, URLs, and domains via Fortinet Proxy and Fortinet WAF to cut offcommand-and-control (C2) communication and active attack traffic.
• Triggerand enforce Forcepoint DLP blocking actions to stop active data exfiltrationattempts.
• Coordinatewith network, infrastructure, and application teams to execute emergencycontainment actions (e.g., firewall rule changes, account disablement, networksegmentation).
• Makefast, risk-based containment decisions under pressure, balancing businesscontinuity against threat severity.

2. Recovery & Restoration (Primary Responsibility)

• Leadremediation efforts to eliminate the root cause — removing malware, closingexploited vulnerabilities, resetting compromised credentials.
• Validatesystem integrity before restoring affected endpoints, applications, or servicesto production.
• Workwith IT/Infra teams to restore data from clean backups where required, ensuringno reinfection.
• Re-enableand monitor previously isolated systems closely post-recovery to confirm thethreat is fully neutralized.
• Verifythat DLP, proxy, WAF, and endpoint policies are restored/tuned appropriatelyafter the incident, avoiding residual exposure.
• Confirmbusiness services are fully operational and communicate recovery status tostakeholders.

3. Root Cause Analysis (RCA) Preparation

• Conductdetailed post-incident investigation to determine the root cause, entry point,attack vector, and scope of impact (systems/users/data affected).
• Reconstructthe full attack timeline using logs from CrowdStrike XDR, SIEM, Forcepoint DLP,Fortinet Proxy, and Fortinet WAF.
• Identifycontributing factors — control gaps, policy misconfigurations, missing patches,human error — that allowed the incident to occur.
• Determinewhy the incident was/wasn't detected earlier and assess detection/responseeffectiveness.
• Documentclear, evidence-backed conclusions and map findings to the MITRE ATT&CKframework where applicable.
• Recommendspecific corrective and preventive actions (CAPA) to eliminate the root causeand reduce recurrence risk.
• PresentRCA findings to SOC leadership and relevant stakeholders (IT, applicationowners, compliance) for sign-off.
• Preparecomprehensive, well-structured incident reports for every confirmed incident,including:
  • Incident summary,severity, and classification
  • Affected systems,users, and data
  • Containment andrecovery actions taken, with timestamps
  • Root cause andcontributing factors
  • Business impactassessment (downtime, data loss, financial/reputational impact)
  • Corrective andpreventive action (CAPA) recommendations with ownership and timelines
• Prepareexecutive summaries for leadership with key metrics (MTTD, MTTC, MTTR) andbusiness-relevant impact in non-technical language.
• Maintainanincident report repository/log for audit, compliance, and trend-analysispurposes.
• Ensurereports meet internal quality standards and any regulatory/compliance reportingobligations (ISO 27001, PCI-DSS, GDPR breach notification timelines, etc., asapplicable).
• Trackclosure of CAPA items from RCA reports and report on their implementationstatus.
• Monitorand triage alerts from CrowdStrike XDR, SIEM, Forcepoint DLP, Fortinet Proxy,and Fortinet WAF to identify genuine incidents needing containment.
• Investigatethe attack timeline, entry point, and scope to inform containment and recoverydecisions.
• Analyzelogs across endpoint, network, proxy, WAF, and DLP sources to trace attackeractivity and confirm full eradication.

6. Incident Management (Process & SLA Ownership)

• Ownincidents end-to-end in the ITSM/ticketing system, ensuring containment,recovery, RCA, and reporting SLAs are all met.
• Documentcontainment and recovery actions in real time during active incidents tosupport accurate RCA and reporting afterward.
• Communicateincident status, and later RCA/report findings, clearly and promptly toleadership.
• Maintainand refine incident response playbooks/runbooks for containment, recovery, RCA,and reporting per threat type (ransomware, data exfiltration, web attack,etc.).
• Recommendpolicy tuning across CrowdStrike, SIEM, Forcepoint DLP, Fortinet Proxy, and WAFbased on RCA findings to reduce future incidents.
• Participatein tabletop exercises and simulations, including RCA/reporting readinessdrills.
• Supportaudits and compliance requirements related to incident handling, RCA, andreporting documentation.

RequiredSkills & Qualifications

1. Technical Skills

• Provenhands-on experience executing containment actions in CrowdStrike Falcon XDR(host isolation, Real-Time Response, process/network containment).
• Experienceactively blocking threats via Fortinet Proxy and Fortinet WAF (URL/IP blocking,rule changes, attack mitigation).
• StrongSIEM skills for rapid investigation, log correlation, and evidence-gathering tosupport RCA (Splunk, QRadar, Sentinel, or similar).
• Solidunderstanding of system recovery processes — backup/restore, credentialrotation, patching, and validation testing.
• Demonstratedability to conduct RCA and write clear, structured incident reports for bothtechnical and executive audiences.
• Familiaritywith MITRE ATT&CK, Cyber Kill Chain, and common attack techniques(ransomware, phishing, lateral movement, data exfiltration).

2. Soft Skills

• Abilityto remain calm and make fast, sound decisions under high-pressure,time-critical situations.
• Strongownership mentality — sees an incident through from containment to fullrecovery to final report closure.
• Excellentcross-team coordination skills (IT, network, application, businessstakeholders) during active incidents.
• Stronganalytical and investigative mindset for root cause determination.
• Excellentwritten communication skills — able to translate technical findings into clear,actionable reports for varied audiences.

EducationalQualifications

• Bachelor'sdegree in Computer Science, Information Technology, Cybersecurity, or relatedfield.

Experience

• 3–6years in Cyber Security Operations/Incident Response, with demonstrableexperience personally executing containment and recovery actions, andindependently preparing RCA and incident reports for live incidents.

KeyPerformance Indicators (KPIs)

• MeanTime to Contain (MTTC) — primary KPI
• MeanTime to Recover (MTTR) — primary KPI
• RCAturnaround time (incident closure to RCA submission)
• Incidentreport quality and timeliness (completeness, accuracy, on-time submission)
• Percentageof incidents contained within SLA before escalation/spread
• Successfulrecovery rate without reinfection/recurrence
• Reductionin repeat/similar incidents attributable to CAPA implementation from RCA
• Requiresavailability for immediate response during active incidents, includingon-call/rotational shifts.
• Closecollaboration with SOC, IT Infra, Network, and Compliance teams duringcontainment, recovery, RCA, and reporting activities.