IR & Forensics – Senior Consultant

Forensic Focus Limited; India; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Forensic Focus Limited is seeking an experienced incident responder to lead investigations into malware, ransomware, data breaches, and insider threats across enterprise, cloud, and hybrid environments.

You will perform triage, containment, forensic analysis, threat hunting, log review, and prepare clear post-incident reports for client stakeholders, working independently under high-pressure conditions and contributing to playbooks and team capability development.

Qualifications

• Hands-on experience with endpoint, network, and cloud forensics across Windows, Linux, and macOS.
• Proficiency with SIEM, EDR, and network security tooling is expected.
• Ability to analyse malware, map attack timelines, and document indicators of compromise under pressure.

Responsibilities

• Lead investigations into malware, ransomware, data breaches, and insider threats.
• Triage and containment during incidents.
• Forensic analysis of endpoints, networks, and cloud environments.
• Threat hunting and log review to identify indicators of compromise.
• Prepare clear, actionable post-incident reports for client stakeholders.
• Contribute to playbooks, tabletop exercises, and team capability development.

Skills

Endpoint forensics

Network forensics

Cloud forensics

Malware analysis

IOC documentation

Threat hunting

Tools

SIEM

EDR

Job description

The Role

This position sits within a cyber incident response practice, where consultants lead investigations into malware, ransomware, data breaches, and insider threats across enterprise, cloud, and hybrid environments. Day-to-day work spans triage, containment, forensic analysis, threat hunting, log review, and preparing clear post-incident reports for client stakeholders.

Skills & Experience

Candidates should bring hands-on experience with endpoint, network, and cloud forensics across Windows, Linux, and macOS platforms. Proficiency with SIEM, EDR, and network security tooling is expected, alongside the ability to analyse malware, map attack timelines, and document indicators of compromise accurately under active-incident pressure.

Who It Suits

This role suits an experienced incident responder who is comfortable operating independently during high-stakes situations and advising non-technical client stakeholders with confidence. Someone who enjoys variety across threat types and industries, and who wants to contribute to playbooks, tabletop exercises, and broader team capability development, will thrive here.