Senior Associate - Incident Response

Huron Eurasia India Private Limited; Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Huron Eurasia India Private Limited in Bengaluru is seeking an Incident Response Senior Associate to perform hands-on investigations, analyze evidence, scope compromises, and drive containment with the Incident Response Manager.

You will reconstruct attacker timelines, determine scope, support eradication and recovery, preserve digital evidence, and produce clear reports that withstand legal, regulatory and audit scrutiny. Willingness to work US hours may be required.

Qualifications

• 3 to 5+ years of hands-on incident response or security operations.
• Undergraduate degree in Information Security, CS or IT.
• Demonstrated experience investigating security incidents end to end.
• Working knowledge of attacker tradecraft and the OSI/ cloud internals needed to investigate it.
• Practical experience with endpoint detection and response tooling, log aggregation and SIEM query languages, and cloud audit logging.
• Strong technical writing skills with ability to produce incident timelines and root cause analyses.

Responsibilities

• Technical triage and investigation of escalated alerts and incidents across endpoints, identities, email, network, and cloud telemetry.
• Reconstruct attacker and user activity into a defensible timeline, identifying what happened and what was affected.
• Determine the scope of compromise, including affected accounts, systems, and data.
• Establish root cause and distinguish confirmed findings from assumptions in every write-up.
• Containment, eradication, and recovery actions with least business disruption.
• Coordinate with IT and platform owners to execute eradication and recovery steps.
• Validate containment effectiveness and ensure no attacker access remains.
• Capture remediation items and hand them to the Incident Response Manager for tracking.
• Collect and preserve digital evidence with proper chain-of-custody across endpoints and cloud services.
• Conduct host and log forensic analysis to support investigations across teams.
• Produce clear reports that withstand legal, regulatory, and audit scrutiny.

Skills

Incident response

Digital forensics

Security operations

EDR tooling

SIEM query languages

Technical writing

Education

Undergraduate degree in Information Security / CS / IT

Tools

SIEM platforms

Cloud audit logging tools

Job description

Incident Response, Senior Associate Huron is redefining what a global consulting organization can be. Advancing new ideas every day to build even stronger clients, individuals and communities. We’re helping our clients find new ways to drive growth, enhance business performance and sustain leadership in the markets they serve. And, we’re developing strategies and implementing solutions that enable the transformative change they need to own their future. As a member of the Huron corporate team, you’ll help to evolve our business model to stay ahead of market forces, industry trends and client needs. Our accounting, finance, human resources, IT, legal, marketing and facilities management professionals work collaboratively to support Huron’s collective strategies and enable real transformation to produce sustainable business results. Join our team and create your future.

Description

Huron's Corporate Information Security team directs the global enterprise information security program, coordinating security efforts across IT, GRC, HR, Legal, and the business units. As incident volume and technical complexity grow, an Incident Response Sr. Associate is needed to provide the hands-on investigative capability behind each incident: analyzing evidence, scoping compromise, driving containment, and establishing root cause, working alongside the Incident Response Manager and other stakeholders.

Key Responsibilities

• Technical triage and investigation: Perform deep-dive analysis of escalated alerts and suspected incidents across endpoint, identity, email, network, and cloud telemetry.
• Reconstruct attacker and user activity into a defensible timeline establishing what happened, when, and what was affected.
• Determine the scope of compromise, including affected accounts, systems, and data.
• Establish root cause and distinguish confirmed findings from assumptions in every write-up.
• Containment, eradication, and recovery: Recommend and support containment actions such as account disablement, host isolation, credential resets, and access revocation.
• Work with IT and platform owners to execute eradication and recovery steps with the least business disruption the situation allows.
• Validate that containment held and that no attacker access or persistence remains before an incident is closed.
• Capture technical remediation items and hand them to the Incident Response Manager for tracking to closure.
• Collect and preserve digital evidence from endpoints, cloud services, and logs, following sound handling and chain-of-custody practice.
• Conduct host and log forensic analysis in support of security, HR, Legal, and privacy investigations.
• Analyze suspicious files, email, and indicators to determine intent and impact, engaging external specialists when depth exceeds internal capability.
• Produce clear technical reports that hold up to legal, regulatory, and audit scrutiny.
• Maintain and improve technical response playbooks, tooling, and evidence collection procedures.
• Feed incident findings to the Lead Threat Hunter so hunting and detection coverage matures against what has actually occurred in the environment.
• Contribute the technical detail behind post-incident reviews, including what happened and what would have surfaced it sooner.
• Support tabletop and ransomware exercises, providing the technical realism these exercises depend on.

Qualifications

• 3 to 5+ years of hands-on experience in incident response, digital forensics, or security operations, preferably in a large company or consulting firm.
• Undergraduate degree, preferably in Information Security, Computer Science, Information Technology, or a related discipline.
• Demonstrated experience investigating security incidents end to end, from initial alert through root cause and closure.
• Working knowledge of attacker tradecraft and a common framework for describing it, along with the operating system, identity, and cloud internals needed to investigate it.
• Practical experience with endpoint detection and response tooling, log aggregation and SIEM query languages, and cloud audit logging.
• Strong technical writing skills, with the ability to produce an incident timeline and root cause analysis a non-specialist can follow.
• Ability to work calmly and methodically under time pressure, with flexibility to extend beyond scheduled hours when an active incident requires it.
• Willingness to work US business hours as needed, coordinating daily with a primarily US-based security team.

Preferred Skills

• Security certifications such as GCIH, GCFA, GCFE, GNFA, OSCP, or similar.
• Experience with digital forensics tooling, including memory and disk analysis.
• Scripting experience (e.g., Python, PowerShell, KQL) used to automate collection, parsing, and analysis.
• Exposure to malware triage or reverse engineering fundamentals.
• Experience supporting insider risk, DLP, or privacy investigations alongside external threat cases.
• Working knowledge of network protocols and traffic analysis, including the ability to interpret firewall, proxy, DNS, and VPN logs to trace activity across the environment.
• Familiarity with cloud platform architecture and native logging across at least one major provider (e.g., Azure, AWS, M365), spanning identity, storage, and workload telemetry, and how each is commonly abused.
• Understanding of application and web security fundamentals, including common vulnerability classes and how exploitation attempts present in application and access logs.
• Experience working across time zones with distributed, cross-functional teams, including US-based stakeholders.
• Analytical problem-solving skills, including the ability to synthesize technical evidence into a format that supports leadership decision-making.

Position Level Senior Associate Country India Experience Level Mid Level