Forensic Analyst

Insight Global; Chennai District; Hybrid; INR 1,400,000 - 2,100,000; Full time

Job summary

Insight Global in Chennai is seeking a Forensic SoC Analyst to investigate cyberattacks, preserve digital evidence, and coordinate with Security, Legal, Compliance, and HR.

You will develop incident response playbooks, improve the Incident Response Program, and ensure proper evidentiary handling with clear documentation for stakeholders.

Hybrid role with a 2pm–11pm IST shift, emphasizing an investigative mindset, data analysis, and cross-functional collaboration to strengthen the IR framework.

Qualifications

• Experience conducting digital forensic investigations with evidence collection, preservation, and timeline analysis.
• Knowledge of eDiscovery lifecycle, legal holds, data preservation, and ESI.
• Experience with MS Purview eDiscovery and MS 365 investigative capabilities.
• Investigative mindset focused on evidence, validation, and objectivity.
• Strong documentation and ability to present findings to technical and non-technical stakeholders.
• Experience supporting incident response, insider investigations, legal requests, or compliance-related investigations.

Responsibilities

• Investigates cyberattacks, suspicious activity, insider threats, and data leaks.
• Collects and preserves digital evidence from computers, emails, cloud systems, and user accounts.
• Partners with Security, Legal, Compliance, and HR teams on investigations and legal matters.
• Helps contain security incidents and prevent recurrence.
• Creates investigation playbooks, response procedures, and improves the Incident Response Program.
• Plays a key role in building the IR program and enhancing the IRP.

Skills

Digital forensics

Analytical skills

Documentation & communication

Attention to detail

Investigative mindset

IR support experience

Tools

eDiscovery Purview

Microsoft Purview eDiscovery

Microsoft 365

Microsoft Sentinel

SIEM

Velociraptor

Job description

Role: Forensic SoC Analyst

Location: Chennai

Mode: Hybrid

Shift: 2pm - 11pm IST

JOB DESCRIPTION

Investigates cyberattacks, suspicious activity, insider threats, and data leaks. Collects and preserves digital evidence from computers, emails, cloud systems, and user accounts. Partners with Security, Legal, Compliance, and HR teams on employee investigations and legal matters. Helps contain security incidents and prevent them from happening again. Creates investigation playbooks, response procedures, and improves the company's Incident Response Program.

REQUIRED SKILLS AND EXPERIENCE

• eDiscovery Purview Microsoft 365 Microsoft Sentinel SIEM
• Experience conducting digital forensic investigations, including evidence collection, preservation, and timeline analysis.
• Strong understanding of the eDiscovery lifecycle, legal holds, data preservation, and electronically stored information (ESI).
• Experience with Microsoft Purview eDiscovery and Microsoft 365 investigative capabilities.
• An investigative mindset focused on following evidence, validating assumptions, and maintaining objectivity throughout investigations.
• Strong analytical skills with the ability to efficiently review large datasets and identify relevant information.
• Excellent documentation and communication skills, with the ability to present findings clearly to both technical and non-technical stakeholders.
• Strong attention to detail and an understanding of evidentiary handling and chain-of-custody considerations.
• While technical expertise is important, qualities such as curiosity, critical thinking, objectivity, and strong documentation skills are equally valuable for this role. Tools can be learned; an investigative mindset is much more difficult to develop.
• Given our environment, candidates with experience supporting incident response, insider investigations, legal requests, or compliance-related investigations would be particularly strong fits.
• These are my recommendations as we begin the hiring process. This individual will also play a key role in building the Incident Response program, developing playbooks, and enhancing the overall Incident Response Plan (IRP).

NICE TO HAVE SKILLS AND EXPERIENCE

• Velociraptor