Opening for Digital Forensic Analyst @ Mumbai

Quess IT Staffing; Mumbai; On-site; INR 700,000 - 1,200,000; Full time

Job summary

Quess IT Staffing is seeking a professional with a strong understanding of Digital Forensics and Incident Response (DFIR) methodologies. The role involves hands-on experience with file system forensics and the ability to analyze and improve SIEM detection logic.

Ideal candidates should have proficiency in Linux and Windows environments, along with scripting capabilities in Python, PowerShell, and Bash. Qualifications include a BE/B Tech in Computer Science or IT, and DFIR-related certifications are preferred.

Skills

Digital Forensics and Incident Response (DFIR)

File system forensics

SIEM detection logic

Threat Hunting

Linux scripting

Windows scripting

Security threats (OWASP Top 10)

SIEM platforms

Cloud Security

Education

BE/B Tech in Computer Science/Information Technology or MCA

DFIR-focused certifications (GCED, GCIA, CEH, OSCP)

Job description

Responsibilities

• Strong understanding of Digital Forensics and Incident Response (DFIR) methodologies.


• Hands-on experience with file system forensics (NTFS, EXT, FAT32) including deleted file recovery, metadata, and artifact analysis.


• Ability to analyse and improve SIEM detection logic and reduce false positives through tuning and validation.


• Ability to perform Threat Hunting aligned with MITRE ATT&CK Standards.


• Proficiency in Linux and Windows environments with scripting capabilities in Python, PowerShell, and Bash for automation and analysis.


• In-depth understanding of security threats (preferably OWASP Top 10 vulnerabilities).


• Basic experience with SIEM platforms such as Azure Sentinel, LogRhythm, XSIAM and Wazuh.


• Understanding of security tools like – HIPS/NIPS, Network Monitoring tools, Cloud Security, AV, EDR, WAF.


• Strong Understanding of Cloud Security for cloud such Azure, GCP and AWS.

Qualifications

• BE/B Tech in Computer Science/Information Technology, or MCA


• Certifications such as GCED, GCIA, CEH, OSCP, or equivalent DFIR-focused certifications preferred.