Incident Response, Senior Associate

HEI Huron Eurasia India Private Limited; Karnataka; On-site; INR 1,200,000 - 2,400,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

Paid time off

Parental leave and adoption assistance

Job summary

Huron Consulting Group is seeking an experienced Incident Response Senior Associate in India to lead hands‑on investigations, triage escalated alerts, and coordinate containment with IT and security teams. The role emphasizes rigorous evidence handling and root‑cause analysis.

You'll work with a global security team across time zones, producing technical timelines and recommendations while contributing to playbooks and post‑incident reviews. A strong writing ability is essential.

Qualifications

• 3 to 5+ years of hands‑on experience in incident response, digital forensics, or security operations.
• Undergraduate degree in Information Security, Computer Science, Information Technology, or related discipline.
• Experience investigating security incidents end to end, from alert to root cause and closure.
• Working knowledge of attacker tradecraft and OS, identity and cloud internals.
• Experience with endpoint detection and response tooling, SIEM, and cloud audit logging.

Responsibilities

• Perform deep‑dive analysis of escalated alerts and incidents across endpoints, identities, email, networks, and cloud telemetry.
• Reconstruct attacker and user activity into a defensible timeline and determine scope of compromise.
• Establish root cause and differentiate findings from assumptions in every write‑up.
• Recommend containment actions and coordinate eradication with IT and platform owners.
• Produce clear technical reports for legal, regulatory, and audit review.

Skills

Incident response

Digital forensics

Security operations

Evidence handling

Technical writing

Education

Bachelor's degree in Information Security / Computer Science / Information Technology

Tools

EDR tooling

SIEM

Cloud auditing

Job description

Huron is redefining what a global consulting organization can be. Advancing new ideas every day to build even stronger clients, individuals and communities. We’re helping our clients find new ways to drive growth, enhance business performance and sustain leadership in the markets they serve. And, we’re developing strategies and implementing solutions that enable the transformative change they need to own their future. As a member of the Huron corporate team, you’ll help to evolve our business model to stay ahead of market forces, industry trends and client needs. Our accounting, finance, human resources, IT, legal, marketing and facilities management professionals work collaboratively to support Huron’s collective strategies and enable real transformation to produce sustainable business results. Join our team and create your future. Huron's Corporate Information Security team directs the global enterprise information security program, coordinating security efforts across IT, GRC, HR, Legal, and the business units. As incident volume and technical complexity grow, an Incident Response Sr. Associate is needed to provide the hands‑on investigative capability behind each incident: analyzing evidence, scoping compromise, driving containment, and establishing root cause, working alongside the Incident Response Manager and other stakeholders.

Description

This individual is responsible for the technical execution of incident response: deep‑dive triage of escalated alerts, evidence collection and analysis across a complex technical environment, scoping the extent of compromise, and recommending and supporting containment and eradication. The role produces the technical findings and timelines that drive decisions during an incident and the root cause analysis that follows it, working closely with the Incident Response Manager, who owns stakeholder coordination and executive reporting. Scope is response‑focused, with periodic collaboration with the broader information security team to feed incident findings into threat hunting, detection engineering, and other program maturation. The role requires dynamic coverage with flexibility to work outside standard business hours when an active incident requires it, and the work demands analytical rigor under time pressure, disciplined evidence handling, and clear technical writing.

Key Responsibilities

Technical triage and investigation

• Perform deep‑dive analysis of escalated alerts and suspected incidents across endpoint, identity, email, network, and cloud telemetry.
• Reconstruct attacker and user activity into a defensible timeline establishing what happened, when, and what was affected.
• Determine the scope of compromise, including affected accounts, systems, and data.
• Establish root cause and distinguish confirmed findings from assumptions in every write‑up.

Containment, eradication, and recovery

• Recommend and support containment actions such as account disablement, host isolation, credential resets, and access revocation.
• Work with IT and platform owners to execute eradication and recovery steps with the least business disruption the situation allows.
• Validate that containment held and that no attacker access or persistence remains before an incident is closed.
• Capture technical remediation items and hand them to the Incident Response Manager for tracking to closure.

Forensics and evidence handling

• Collect and preserve digital evidence from endpoints, cloud services, and logs, following sound handling and chain‑of‑custody practice.
• Conduct host and log forensic analysis in support of security, HR, Legal, and privacy investigations.
• Analyze suspicious files, email, and indicators to determine intent and impact, engaging external specialists when depth exceeds internal capability.
• Produce clear technical reports that hold up to legal, regulatory, and audit scrutiny.

Response readiness and continuous improvement

• Maintain and improve technical response playbooks, tooling, and evidence collection procedures.
• Feed incident findings to the Lead Threat Hunter so hunting and detection coverage matures against what has actually occurred in the environment.
• Contribute the technical detail behind post‑incident reviews, including what happened and what would have surfaced it sooner.
• Support tabletop and ransomware exercises, providing the technical realism these exercises depend on.

Qualifications

• 3 to 5+ years of hands‑on experience in incident response, digital forensics, or security operations, preferably in a large company or consulting firm.
• Undergraduate degree, preferably in Information Security, Computer Science, Information Technology, or a related discipline.
• Demonstrated experience investigating security incidents end to end, from initial alert through root cause and closure.
• Working knowledge of attacker tradecraft and a common framework for describing it, along with the operating system, identity, and cloud internals needed to investigate it.
• Practical experience with endpoint detection and response tooling, log aggregation and SIEM query languages, and cloud audit logging.
• Strong technical writing skills, with the ability to produce an incident timeline and root cause analysis a non‑specialist can follow.
• Ability to work calmly and methodically under time pressure, with flexibility to extend beyond scheduled hours when an active incident requires it.
• Willingness to work US business hours as needed, coordinating daily with a primarily US‑based security team.

Preferred Skills

• Security certifications such as GCIH, GCFA, GCFE, GNFA, OSCP, or similar.
• Experience with digital forensics tooling, including memory and disk analysis.
• Scripting experience (e.g., Python, PowerShell, KQL) used to automate collection, parsing, and analysis.
• Exposure to malware triage or reverse engineering fundamentals.
• Experience supporting insider risk, DLP, or privacy investigations alongside external threat cases.
• Working knowledge of network protocols and traffic analysis, including the ability to interpret firewall, proxy, DNS, and VPN logs to trace activity across the environment.
• Familiarity with cloud platform architecture and native logging across at least one major provider (e.g., Azure, AWS, M365), spanning identity, storage, and workload telemetry, and how each is commonly abused.
• Understanding of application and web security fundamentals, including common vulnerability classes and how exploitation attempts present in application and access logs.
• Experience working across time zones with distributed, cross‑functional teams, including US‑based stakeholders.
• Analytical problem‑solving skills, including the ability to synthesize technical evidence into a format that supports leadership decision‑making.

Position Level Senior Associate Country India

At Huron, we’re redefining what a consulting organization can be. We go beyond advice to deliver results that last. We inherit our client’s challenges as if they were our own. We help them transform for the future. We advocate. We make a difference. And we intelligently, passionately, relentlessly do great work…together. Are you the kind of person who stands ready to jump in, roll up your sleeves and transform ideas into action? Then come discover Huron. Whether you have years of experience or come right out of college, we invite you to explore our many opportunities. Find out how you can use your talents and develop your skills to make an impact immediately. Learn about how our culture and values provide you with the kind of environment that invites new ideas and innovation. Come see how we collaborate with each other in a culture of learning, coaching, diversity and inclusion. And hear about our unwavering commitment to make a difference in partnership with our clients, shareholders, communities and colleagues.

Huron Consulting Group offers a competitive compensation and benefits package including medical, dental, and vision coverage to employees and dependents; a 401(k) plan with a generous employer match; an employee stock purchase plan; a generous Paid Time Off policy; and paid parental leave and adoption assistance. Our Wellness Program supports employee total well‑being by providing free annual health screenings and coaching, bank at work, and on‑site workshops, as well as ongoing programs recognizing major events in the lives of our employees throughout the year. All benefits and programs are subject to applicable eligibility requirements.

Huron is fully committed to providing equal employment opportunity to job applicants and employees in recruitment, hiring, employment, compensation, benefits, promotions, transfers, training, and all other terms and conditions of employment. Huron will not discriminate on the basis of age, race, color, gender, marital status, sexual orientation, gender identity, pregnancy, national origin, religion, veteran status, physical or mental disability, genetic information, creed, citizenship or any other status protected by laws or regulations in the locations where we do business. We endeavor to maintain a drug‑free workplace.