DFIR Specialist

Persistent Systems; Mumbai; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Forensic Focus is seeking a seasoned cybersecurity professional in Mumbai to lead incident response and digital forensics. The role focuses on investigating malware, phishing, ransomware, and account compromise, performing forensic analysis of endpoints and logs, and coordinating with SOC and infrastructure teams during response efforts.

The ideal candidate has 8–12 years of DFIR and IAM experience, strong Windows and Linux forensic skills, and familiarity with SIEM/EDR tools, IOC

Qualifications

• 8–12 years of experience in DFIR, IAM and Microsoft Entra ID.
• Strong Windows and Linux forensic skills (disk/mmemory/network).
• Familiar with SIEM/EDR tools, malware analysis, IOC identification and MITRE ATT&CK.

Responsibilities

• Forensic acquisition and analysis of endpoints and logs.
• Incident triage, containment and timeline reconstruction.

Skills

DFIR

IAM

Entra ID

Windows

Linux

SIEM

EDR

Malware analysis

IOC identification

MITRE ATT&CK

Tools

SIEM tools

EDR tools

Job description

The Role

This position involves investigating cybersecurity incidents such as malware, phishing, ransomware and account compromise. Responsibilities include forensic acquisition and analysis of endpoints and logs, incident triage, containment, timeline reconstruction, and collaboration with SOC and infrastructure teams during response efforts.

Skills & Experience

Candidates need 8-12 years' experience in DFIR, IAM and Microsoft Entra ID, with strong Windows and Linux forensic skills covering disk, memory, file-system and network analysis. Familiarity with SIEM, EDR tools, malware analysis, IOC identification and MITRE ATT&CK is expected.

Who It Suits

This role suits a seasoned forensic investigator or incident responder comfortable handling complex security incidents end-to-end, who enjoys technical analysis, evidence handling, and cross-team collaboration within a large enterprise cybersecurity function.