Senior Security Consultant

uvcyber; Hyderabad; On-site; INR 1,400,000 - 2,100,000; Full time

Job summary

uvcyber is seeking a Senior Cybersecurity Incident Response Specialist with 8-10 years of hands-on experience to lead and manage security incidents across enterprise environments in India. The role covers triage, containment, eradication, recovery, RCA, malware analysis, and digital forensic analysis, with strong customer-facing responsibilities to present findings and recommendations.

You will coordinate with SOC, Threat Intelligence, IT, Cloud, and Legal teams, providing updates and strategic

Qualifications

• 8-10 years of hands-on cybersecurity experience.
• End-to-end ownership of security incidents.
• Capable of RCA, malware analysis, and digital forensics.
• Strong ability to lead incident discussions with customers and stakeholders.
• Ability to map findings to MITRE ATT&CK framework.
• Coordinate with multiple internal and customer teams during major incidents.

Responsibilities

• Take end-to-end ownership of cybersecurity incidents from initial detection through closure.
• Lead investigation of critical, high, and complex security incidents and coordinate response activities across relevant teams.
• Perform incident triage, scoping, containment, eradication, recovery, and post-incident analysis.
• Investigate incidents involving ransomware, malware, phishing, account compromise, credential theft, data exfiltration, insider threats, web attacks, and lateral movement.
• Analyze security alerts and correlate information across EDR, SIEM, network, identity, cloud, and email security technologies.
• Develop incident timelines and determine attack vectors, affected assets, and attacker activity.
• Identify IOCs, TTPs, and map findings to MITRE ATT&CK.
• Coordinate with SOC, Threat Hunting, IT, Cloud, IAM, Legal, and other stakeholders during major incidents.

Skills

Incident Response

DFIR

Malware Analysis

Digital Forensics

RCA

Stakeholder Management

Customer-facing

Tools

EDR

SIEM

Job description

Job Description - Senior Cybersecurity Incident Response Specialist

Experience: 8-10 Years

Function: Cybersecurity - Incident Response / DFIR

Role Level: Senior

Role Overview

We are looking for an experienced Cybersecurity Incident Response Specialist with 8-10 years of hands-on cybersecurity experience to manage and investigate security incidents across enterprise environments.

The candidate will be responsible for end-to-end ownership of cybersecurity incidents, including triage, investigation, containment, eradication, recovery, Root Cause Analysis (RCA), malware analysis, and digital forensic analysis. The role also requires strong customer-facing skills to lead incident discussions, provide regular updates, explain technical findings, and present investigation outcomes and recommendations.

Key Responsibilities

• Incident Response & Investigation
  • Take end-to-end ownership of cybersecurity incidents from initial detection through closure.
  • Lead investigation of Critical, High, and complex security incidents and coordinate response activities across relevant teams.
  • Perform incident triage, scoping, containment, eradication, recovery, and post-incident analysis.
  • Investigate incidents involving ransomware, malware, phishing, account compromise, credential theft, data exfiltration, insider threats, web attacks, lateral movement, privilege escalation, and other advanced threats.
  • Analyze security alerts and correlate information across EDR, SIEM, network, identity, cloud, email, and other security technologies.
  • Develop incident timelines and determine the attack vector, affected assets, compromised accounts, attacker activity, persistence mechanisms, and overall impact.
  • Identify Indicators of Compromise (IOCs), attacker Tactics, Techniques, and Procedures (TTPs), and map findings to the MITRE ATT&CK framework.
  • Coordinate with SOC, Threat Hunting, Threat Intelligence, IT, Cloud, Network, IAM, Application, Legal, and other stakeholders during major incidents.
• Root Cause Analysis (RCA)
  • Perform detailed Root Cause Analysis for security incidents.
  • Determine the initial attack vector, contributing factors, security/control gaps, and reasons existing preventive or detective controls did not stop or detect the activity earlier.
  • Conduct post-incident reviews and lessons-learned sessions.
  • Develop clear corrective and preventive actions based on investigation findings.
  • Track remediation recommendations with relevant stakeholders through closure.
  • Prepare comprehensive RCA reports suitable for technical teams, management, and customers.
• Malware Analysis
  • Perform static and dynamic malware analysis to understand malicious file behavior and capabilities.
  • Analyze suspicious executables, scripts, PowerShell commands, documents, URLs, and other artifacts.
  • Identify malware persistence mechanisms, command-and-control activity, network indicators, file-system changes, registry modifications, and related behaviors.
  • Extract IOCs and behavioral indicators for threat hunting and detection engineering.
  • Perform malware sandboxing and behavioral analysis where required.
  • Provide recommendations for detection, containment, and prevention based on malware-analysis findings.
• Digital Forensics
  • Perform digital forensic investigations on endpoints and other relevant systems.
  • Analyze Windows/Linux artifacts, event logs, file systems, registry artifacts, browser artifacts, authentication logs, memory artifacts, and other forensic evidence.
  • Perform disk and memory analysis where required.
  • Collect and preserve digital evidence following appropriate forensic procedures and chain-of-custody requirements.
  • Build forensic timelines and reconstruct attacker activities.
  • Determine the scope and impact of compromise using forensic evidence.
  • Document forensic findings clearly and maintain investigation evidence appropriately.
• Customer & Stakeholder Management
  • Act as a key technical point of contact for customers during cybersecurity incidents.
  • Lead incident calls and communicate investigation progress, impact, containment status, risks, and next steps.
  • Provide timely and accurate incident updates to customers and internal leadership.
  • Translate complex technical investigation findings into clear business-level communication.
  • Manage customer expectations during high-severity and time-sensitive incidents.
  • Present RCA and forensic investigation findings to customers and senior stakeholders.
  • Handle technical questions and confidently explain investigation methodology, evidence, conclusions, and recommendations.
  • Coordinate with multiple internal and customer teams to drive incidents toward timely resolution.
• Incident Reporting & Documentation
  • Prepare detailed incident investigation reports, including:
  • Maintain accurate incident records, evidence, investigation notes, and supporting documentation.
  • Contribute to the development and improvement of Incident Response playbooks, SOPs, investigation procedures, and escalatio