Digital Forensics and Incident Response

Allegis Group; Chennai; On-site; INR 1,200,000 - 2,000,000; Full time

Job summary

Allegis Group is seeking a senior DFIR professional in Chennai, India, to lead investigations and digital forensics across endpoints and cloud. You will coordinate cross-functional teams for containment, remediation, and regulatory reporting.

The role requires strong leadership, deep forensic expertise across multiple domains, and collaboration with legal, compliance, and audit functions. Prior experience with enterprise-scale incidents is essential.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Engineering, IT, or equivalent experience.
• 5-15 years of cybersecurity experience with DFIR focus.
• Experience leading enterprise-scale cyber investigations including ransomware, malware, threats and data exfiltration.
• Deep forensics across endpoint, memory, disk, network, identity, email and cloud.
• Experience supporting legal, regulatory, audit and evidentiary requirements including chain-of-custody.

Responsibilities

• Lead investigations and response activities for cybersecurity incidents (ransomware, malware, insider threats, credential compromise, data breaches).
• Direct digital forensic investigations across endpoint, memory, network, identity, email and cloud environments.
• Coordinate cross-functional response efforts for containment, eradication, recovery, and regulatory reporting.
• Perform advanced forensic analysis and attack-path reconstruction to support decisions.
• Translate findings into detections, threat hunting use cases, playbooks, and security improvements.
• Mature DFIR readiness with standards, tabletop exercises, and preparedness programs.
• Provide technical leadership and executive reporting for audit and compliance.

Skills

DFIR expertise

Incident response leadership

Executive reporting

Stakeholder management

Analytical thinking

Education

Bachelor's degree in Cybersecurity, Computer Science, Engineering, IT, or equivalent

Tools

Splunk Enterprise Security

Microsoft Defender XDR

CrowdStrike Falcon

Palo Alto Cortex XDR

Cortex XSOAR

Velociraptor

Volatility

KAPE

Magnet AXIOM

EnCase

FTK

Wireshark

YARA

Job description

Key Responsibilities:

• Lead investigations and response activities for cybersecurity incidents, including ransomware, malware, insider threats, credential compromise, and data breaches.
• Direct digital forensic investigations across endpoint, memory, network, identity, email, and cloud environments to determine attack scope, root cause, business impact, and remediation requirements.
• Coordinate cross-functional response efforts supporting containment, eradication, recovery, regulatory reporting, and post-incident remediation activities.
• Perform advanced forensic analysis, attack-path reconstruction, malware investigations, evidence correlation, and incident scoping to support accurate and timely decision-making.
• Improve cyber defense capabilities by translating investigation findings into detections, threat hunting use cases, incident response playbooks, automation opportunities, and security control improvements.
• Mature DFIR readiness through improved incident response standards, forensic procedures, tabletop exercises, simulations, and response preparedness programs.
• Provide technical leadership, mentorship, executive reporting, and support for audit, legal, compliance, and evidentiary requirements.

Required Qualifications:

• 5 - 15 years of cybersecurity experience, including significant hands-on expertise in Digital Forensics & Incident Response (DFIR).
• Proven experience leading enterprise-scale cyber investigations involving ransomware, malware, insider threats, cloud incidents, credential compromise, advanced threats, and data exfiltration.
• Deep expertise in endpoint, memory, disk, network, identity, email, and cloud forensics, along with incident response, threat hunting, attack-path analysis, and detection engineering principles.
• Experience supporting legal, regulatory, compliance, audit, and evidentiary requirements, including chain-of-custody and forensic evidence preservation.
• Strong leadership, communication, stakeholder management, investigative, analytical, and executive reporting skills.
• Bachelor's degree in Cybersecurity, Computer Science, Engineering, Information Technology, or equivalent experience.

Security Technologies:

• Security Technologies: Splunk Enterprise Security, Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike Falcon, Palo Alto Cortex XDR, Palo Alto Cortex XSOAR, Velociraptor, Volatility, KAPE, Magnet AXIOM, EnCase, FTK, Wireshark, YARA, Sysinternals, Microsoft Azure, Microsoft 365, AWS, Active Directory, Microsoft Entra ID, Windows, Linux, SIEM, SOAR, EDR/XDR, cloud security, threat intelligence, forensic analysis, and security automation platforms.