Senior Incident Responder - Detection & DFIR

Neurealm; Ernakulam, Pune District, Bengaluru; Vor Ort; INR 4.000.000 - 6.000.000; Vollzeit

Zusammenfassung

Neurealm Company seeks an experienced Cyber Incident Responder to own responses to serious security incidents across hybrid healthcare and pharma environments. You will guide containment, forensics, and regulatory reporting while shaping how we detect threats to improve defenses.

You will coordinate with IT, legal, privacy and business leaders, mentor L2 analysts, and lead tabletop exercises. Experience with CrowdStrike Falcon and Entra ID/Azure is essential, along with memory/disk forensics and

Qualifikationen

• 10+ years in security with hands-on IR leadership.
• Strong CrowdStrike Falcon experience (RTR, Insight XDR, Next-Gen SIEM).
• Windows internals and Active Directory attacks and forensic artefacts.
• Entra ID and Azure attack investigation capabilities.
• Memory and disk forensics, log analysis, and timeline building.
• Clear communication with technical teams and executives under pressure.

Aufgaben

• Lead response to high-severity incidents across hybrid healthcare environments.
• Run containment and eradication using CrowdStrike and Entra ID/Azure controls.
• Act as incident commander coordinating IT, legal, privacy, and external DFIR.
• Support breach assessment and regulatory reporting including CERT-In & DPDP obligations.
• Perform host forensics, memory analysis, and timeline reconstruction.
• Investigate identity and cloud attacks using Entra ID and Azure logs.
• Turn findings into detections in Falcon Next-Gen SIEM and lead threat hunts.
• Write post-incident reports with root cause and remediation; track actions.
• Mentor L2 analysts and serve as top escalation on shift.

Kenntnisse

Incident response leadership

CrowdStrike Falcon

Windows internals/AD attacks

Entra ID/Azure investigations

Memory and disk forensics

Log analysis & timeline reconstruction

Communication under pressure

Tools

Falcon Forensics

Velociraptor

KAPE

Volatility

Jobbeschreibung

Role summary

You will own the response to serious security incidents across hybrid healthcare and pharma environments, from first containment through forensics, root cause and regulatory reporting. You will also shape what the SOC detects, so every incident turns into better detections. The two responders share detection strategy and DFIR and cover each other across shifts.

Key responsibilities

Incident response

• Lead response to high-severity incidents: ransomware, business email compromise, identity compromise, insider misuse, data exfiltration and cloud account takeover.
• Run containment and eradication using CrowdStrike Falcon (Real Time Response, network containment, Falcon Fusion SOAR workflows) and Entra ID / Azure controls.
• Act as incident commander when needed, coordinating IT, application owners, legal, privacy and business leaders, and external DFIR retainers.
• Support breach assessment and regulatory notification, including CERT-In reporting timelines and DPDP Act obligations for patient and personal data.

Digital forensics

• Perform host forensics (Windows, Linux), memory analysis and timeline reconstruction using tools such as Falcon Forensics, Velociraptor, KAPE and Volatility.
• Investigate identity and cloud attacks using Entra ID sign-in and audit logs, Azure Activity logs and M365 unified audit logs.
• Preserve evidence with proper chain of custody for legal and regulatory use.
• Perform triage-level malware analysis (static and dynamic) and extract IOCs and TTPs.

Detection strategy

• Turn incident findings into new or tuned detections in Falcon Next-Gen SIEM, mapped to MITRE ATT&CK.
• Lead hypothesis-driven threat hunts on healthcare-relevant threats: ransomware groups, identity attacks, attacks on clinical and R&D systems.
• Own IR playbooks and runbooks; run tabletop exercises with technical and leadership teams.
• Write post-incident reports with root cause, impact and remediation, and track actions to closure.

Leadership

• Mentor L2 analysts on investigation depth and forensic technique.
• Serve as the top escalation point on shift and during on-call.

Must-have skills

• 10+ years in security, with deep hands-on incident response leading real-world, high‑severity incidents.
• Strong CrowdStrike Falcon experience (Insight XDR, RTR, Next-Gen SIEM / LogScale query language).
• Windows internals and Active Directory attacks (Kerberoasting, DCSync, pass-the-hash, golden tickets) and their forensic artefacts.
• Entra ID and Azure attack investigation: token theft, consent phishing, MFA fatigue, cloud privilege escalation.
• Memory and disk forensics, log analysis and timeline building.
• Clear communication with technical teams and executives under pressure.

Good to have

• Incident experience in healthcare, pharma or other regulated sectors.
• Container and Kubernetes (AKS) incident investigation.
• Scripting in Python or PowerShell for triage and automation.
• Certifications: GCFA, GCIH, GNFA, GREM, CrowdStrike CCFR/CCFH, or equivalent.
• Looking for Immediate Joiners

What success looks like in 12 months

• Mean time to contain high‑severity incidents measurably reduced.
• IR playbooks for the top 10 incident types written, tested and in use.
• At least two tabletop exercises run, including one with leadership.
• Every major incident closed with a post‑incident review and new detections.