SOC Analyst – Digital Forensics & Incident

Forensic Focus; Dadri; On-site; INR 900,000 - 1,500,000; Full time

Job summary

Forensic Focus is seeking a seasoned SOC/DFIR professional to investigate escalated incidents with hands‑on expertise in host triage, malware analysis, and evidence collection. You will correlate indicators across endpoint, network, cloud, and email telemetry, documenting findings defensibly and supporting rapid containment in a 24x7 operations setup.

Ideal candidates have 5–7 years of experience in DFIR, with proficiency in CrowdStrike, Netskope, FortiGate, Cloudflare, AWS and Mimecast, and

Qualifications

• Experience in digital forensics and incident response (DFIR).
• Familiarity with host triage, process tree analysis and Windows/Linux artifacts.
• Solid malware analysis skills and practical DFIR tooling experience.

Responsibilities

• Support escalated SOC incidents requiring deep technical investigation.
• Conduct host triage, evidence collection and malware‑related analysis.
• Reconstruct incidents and correlate findings across endpoint, network, cloud and email telemetry.
• Document evidence defensibly and assist containment in a 24x7 environment.

Skills

DFIR expertise

Malware analysis

Host triage

Windows artifacts

Linux artifacts

Tools

CrowdStrike

Netskope

FortiGate

Cloudflare

AWS

Mimecast

Job description

The Role

This position supports escalated SOC incidents requiring deeper technical investigation, including host triage, evidence collection, malware‑related analysis, and incident reconstruction. It involves correlating findings across endpoint, network, cloud, and email security telemetry, documenting evidence defensibly, and supporting containment within a 24x7 operational environment.

Skills & Experience

Candidates need digital forensics and incident response expertise, malware analysis skills, and familiarity with host triage, process tree analysis, and Windows/Linux forensic artifacts. Tools include CrowdStrike, Netskope, FortiGate, Cloudflare, AWS, Mimecast, and basic scripting. Certifications like GCFA, GCFE, GCIH, CHFI, or SC-200 are preferred.

Who It Suits

Ideal for experienced SOC analysts or DFIR practitioners with five to seven years' experience who enjoy hands‑on technical investigation of escalated incidents without working in a purely lab‑based forensic role.