Senior Incident Responder - Detection & DFIR

The Adlakha Group; Bengaluru; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

The Adlakha Group is seeking an experienced incident responder with 10+ years in security to lead real-world incident response. You will tackle ransomware, identity compromise and other high-severity incidents, applying deep hands-on expertise with CrowdStrike Falcon, RTR, SIEM/LogScale, Entra ID and Azure.

Proficiency in Windows/Linux forensics, memory analysis, and evidence preservation is essential. You'll translate incident learnings into enhanced detections, playbooks, and threat hunts,

Qualifications

• 10+ years in security with hands-on incident response leadership.
• Experience leading response to ransomware, identity compromise, BEC, cloud account takeover, data exfiltration and other high-severity incidents.
• Strong hands-on knowledge of CrowdStrike Falcon, RTR, Falcon Next-Gen SIEM/LogScale, Entra ID and Azure.
• Windows/Linux forensics, memory analysis, timeline reconstruction and evidence preservation.
• Familiarity with tools such as Falcon Forensics, Velociraptor, KAPE and Volatility.
• Strong knowledge of AD and identity attacks including Kerberoasting, DCSync, pass‑the‑hash, token theft and consent phishing.
• Ability to convert incident learnings into improved detections, playbooks and threat hunts.

Responsibilities

• Respond to serious, real-world security incidents, not just coordinated incident tickets.
• Lead response to ransomware, identity compromise and other high-severity events.

Skills

Incident response

Ransomware response

Threat hunting

Forensics

Cloud security

Tools

CrowdStrike Falcon

RTR

Falcon Next-Gen SIEM/LogScale

Entra ID

Azure

Velociraptor

KAPE

Volatility

Job description

We need an experienced responder who has handled serious, real-world security incidents, not just coordinated incident tickets.

What we need:

• 10+ years in security with deep hands-on incident response experience.
• Experience leading response to ransomware, identity compromise, BEC, cloud account takeover, data exfiltration and other high-severity incidents.
• Strong hands-on knowledge of CrowdStrike Falcon, RTR, Falcon Next-Gen SIEM/LogScale, Entra ID and Azure.
• Windows/Linux forensics, memory analysis, timeline reconstruction and evidence preservation.
• Familiarity with tools such as Falcon Forensics, Velociraptor, KAPE and Volatility.
• Strong knowledge of AD and identity attacks including Kerberoasting, DCSync, pass‑the‑hash, token theft and consent phishing.
• Ability to convert incident learnings into improved detections, playbooks and threat hunts.