Digital Forensics & Incident Response (DFIR)

TEKsystems; Chennai; On-site; INR 1,200,000 - 2,400,000; Full time

Job summary

TEKsystems is seeking a senior cybersecurity professional to lead DFIR investigations and incident response across enterprise environments. You will coordinate cross-functional teams, perform advanced forensic analysis, and guide remediation and regulatory reporting.

You will mentor junior staff, report to executives, and help mature incident response standards, playbooks, and evidence handling. A strong background in endpoint, memory, network, and cloud forensics is required.

Qualifications

• 5-15 years of cybersecurity experience with hands-on DFIR.
• Proven experience leading enterprise-scale cyber investigations including ransomware, malware, and data exfiltration.
• Deep expertise across endpoint, memory, disk, network, identity, email, and cloud forensics.
• Experience supporting legal, regulatory, audit, and evidentiary requirements with chain-of-custody.
• Strong leadership, communication, stakeholder management, and executive reporting skills.

Responsibilities

• Lead investigations and response activities for cybersecurity incidents including ransomware and data breaches.
• Direct digital forensics across endpoints, memory, network, identity, email, and cloud environments.
• Coordinate cross-functional response efforts for containment, eradication, recovery, and regulatory reporting.
• Perform advanced forensic analysis and incident scoping to support timely decisions.
• Translate findings into detections, threat hunting use cases, and improved security controls.
• Mature incident response readiness through procedures, exercises, and preparedness programs.

Skills

DFIR expertise

Incident response leadership

Executive reporting

Stakeholder management

Analytical reasoning

Communication skills

Education

Bachelor's degree in Cybersecurity/CS/Engineering/IT

Tools

Splunk Enterprise Security

Microsoft Defender XDR

CrowdStrike Falcon

Palo Alto Cortex XDR

Cortex XSOAR

Volatility

KAPE

Magnet AXIOM

EnCase

FTK

Wireshark

YARA

Sysinternals

Azure

Job description

Lead investigations and response activities for cybersecurity incidents, including ransomware, malware, insider threats, credential compromise, and data breaches.

Direct digital forensic investigations across endpoint, memory, network, identity, email, and cloud environments to determine attack scope, root cause, business impact, and remediation requirements.

Coordinate cross-functional response efforts supporting containment, eradication, recovery, regulatory reporting, and post-incident remediation activities.

Perform advanced forensic analysis, attack-path reconstruction, malware investigations, evidence correlation, and incident scoping to support accurate and timely decision-making.

Improve cyber defense capabilities by translating investigation findings into detections, threat hunting use cases, incident response playbooks, automation opportunities, and security control improvements.

Mature DFIR readiness through improved incident response standards, forensic procedures, tabletop exercises, simulations, and response preparedness programs.

Provide technical leadership, mentorship, executive reporting, and support for audit, legal, compliance, and evidentiary requirements.

Required Qualifications:

• 5 - 15 years of cybersecurity experience, including significant hands-on expertise in Digital Forensics & Incident Response (DFIR).
• Proven experience leading enterprise-scale cyber investigations involving ransomware, malware, insider threats, cloud incidents, credential compromise, advanced threats, and data exfiltration.
• Deep expertise in endpoint, memory, disk, network, identity, email, and cloud forensics, along with incident response, threat hunting, attack-path analysis, and detection engineering principles.
• Experience supporting legal, regulatory, compliance, audit, and evidentiary requirements, including chain-of-custody and forensic evidence preservation.
• Strong leadership, communication, stakeholder management, investigative, analytical, and executive reporting skills.
• Bachelor's degree in Cybersecurity, Computer Science, Engineering, Information Technology, or equivalent experience.

Security Technologies:

Splunk Enterprise Security, Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike Falcon, Palo Alto Cortex XDR, Palo Alto Cortex XSOAR, Velociraptor, Volatility, KAPE, Magnet AXIOM, EnCase, FTK, Wireshark, YARA, Sysinternals, Microsoft Azure, Microsoft 365, AWS, Active Directory, Microsoft Entra ID, Windows, Linux, SIEM, SOAR, EDR/XDR, cloud security, threat intelligence, forensic analysis, and security automation platforms.