Incident Response, Senior Associate

Huron Consulting; Karnataka; Presencial; INR 1.200.000 - 2.500.000; Tempo integral

Resumo da vaga

Huron Consulting in Bengaluru, India, seeks an Incident Response Sr. Associate to lead deep-dive investigations, triage escalated alerts, collect evidence, and map attacker activity with defensible timelines.

You will determine scope of compromise and support containment, collaborating with IT, Legal and HR as needed. This role emphasizes rigorous evidence handling, clear technical reporting, and collaboration with threat hunting and remediation efforts to improve detection and response

Qualificações

• 3 to 5+ years of hands-on experience in incident response, digital forensics, or security operations.
• Undergraduate degree in Information Security, Computer Science, Information Technology, or related discipline.
• Demonstrated end-to-end investigation experience from initial alert to root cause and closure.
• Working knowledge of attacker tradecraft and framework-aligned descriptions; OS, identity and cloud internals basics.

Responsabilidades

• Perform deep-dive analysis of escalated alerts and incidents across endpoint, identity, email, network, and cloud telemetry.
• Reconstruct attacker activity into a defensible timeline and determine scope of compromise.
• Establish root cause and distinguish findings from assumptions in every write-up.
• Recommend containment actions and work with IT to execute eradication with minimal business disruption.
• Validate containment and hand technical remediation items to the Incident Response Manager for closure.
• Collect and preserve digital evidence with proper chain-of-custody; conduct host/log forensics.
• Produce clear technical reports for legal, regulatory and audit purposes.
• Maintain and improve incident response playbooks; contribute to threat hunting and detection coverage.
• Support tabletop and ransomware exercises with realistic technical detail.

Conhecimentos

Incident response

Digital forensics

Security operations

Formação

Undergraduate degree in Information Security / CS / IT

Descrição da vaga

Huron is redefining what a global consulting organization can be. Advancing new ideas every day to build even stronger clients, individuals and communities. We're helping our clients find new ways to drive growth, enhance business performance and sustain leadership in the markets they serve. And, we're developing strategies and implementing solutions that enable the transformative change they need to own their future.

As a member of the Huron corporate team, you'll help to evolve our business model to stay ahead of market forces, industry trends and client needs. Our accounting, finance, human resources, IT, legal, marketing and facilities management professionals work collaboratively to support Huron's collective strategies and enable real transformation to produce sustainable business results.

Join our team and create your future.

Huron's Corporate Information Security team directs the global enterprise information security program, coordinating security efforts across IT, GRC, HR, Legal, and the business units. As incident volume and technical complexity grow, an Incident Response Sr. Associate is needed to provide the hands-on investigative capability behind each incident: analyzing evidence, scoping compromise, driving containment, and establishing root cause, working alongside the Incident Response Manager and other stakeholders.

Description

This individual is responsible for the technical execution of incident response: deep-dive triage of escalated alerts, evidence collection and analysis across a complex technical environment, scoping the extent of compromise, and recommending and supporting containment and eradication. The role produces the technical findings and timelines that drive decisions during an incident and the root cause analysis that follows it, working closely with the Incident Response Manager, who owns stakeholder coordination and executive reporting. Scope is response-focused, with periodic collaboration with the broader information security team to feed incident findings into threat hunting, detection engineering, and other program maturation. The role requires dynamic coverage with flexibility to work outside standard business hours when an active incident requires it, and the work demands analytical rigor under time pressure, disciplined evidence handling, and clear technical writing.

Key Responsibilities

Technical triage and investigation

• Perform deep-dive analysis of escalated alerts and suspected incidents across endpoint, identity, email, network, and cloud telemetry.
• Reconstruct attacker and user activity into a defensible timeline establishing what happened, when, and what was affected.
• Determine the scope of compromise, including affected accounts, systems, and data.
• Establish root cause and distinguish confirmed findings from assumptions in every write-up.

Containment, eradication, and recovery

• Recommend and support containment actions such as account disablement, host isolation, credential resets, and access revocation.
• Work with IT and platform owners to execute eradication and recovery steps with the least business disruption the situation allows.
• Validate that containment held and that no attacker access or persistence remains before an incident is closed.
• Capture technical remediation items and hand them to the Incident Response Manager for tracking to closure.

Forensics and evidence handling

• Collect and preserve digital evidence from endpoints, cloud services, and logs, following sound handling and chain-of-custody practice.
• Conduct host and log forensic analysis in support of security, HR, Legal, and privacy investigations.
• Analyze suspicious files, email, and indicators to determine intent and impact, engaging external specialists when depth exceeds internal capability.
• Produce clear technical reports that hold up to legal, regulatory, and audit scrutiny.

Response readiness and continuous improvement

• Maintain and improve technical response playbooks, tooling, and evidence collection procedures.
• Feed incident findings to the Lead Threat Hunter so hunting and detection coverage matures against what has actually occurred in the environment.
• Contribute the technical detail behind post-incident reviews, including what happened and what would have surfaced it sooner.
• Support tabletop and ransomware exercises, providing the technical realism these exercises depend on.

Qualifications

• 3 to 5+ years of hands-on experience in incident response, digital forensics, or security operations, preferably in a large company or consulting firm.
• Undergraduate degree, preferably in Information Security, Computer Science, Information Technology, or a related discipline.
• Demonstrated experience investigating security incidents end to end, from initial alert through root cause and closure.
• Working knowledge of attacker tradecraft and a common framework for describing it, along with the operating system, identity, and cloud internals neede