INDIA - Senior Security Incident Responder

Insight Global; Wilmington (DE); On-site; USD 140,000 - 190,000; Full time

Job summary

Insight Global is seeking a Senior Security Incident Responder to lead investigations, containment, eradication, and recovery of cybersecurity incidents across the enterprise. You will act as a technical lead during major incidents, coordinating with security operations, infrastructure, legal, privacy, and business teams.

You will leverage SIEM, EDR, threat intel, and forensic techniques to determine attack scope, root cause, and remediation actions, while driving playbook development and

Qualifications

• 10+ years in cybersecurity with SOC and Incident Response experience.
• Experience leading investigations of major cyber incidents and breaches.
• Strong incident response methodologies and forensics knowledge.
• Experience in enterprise/global environments with complex security.
• Ability to coordinate technical and non-technical stakeholders under pressure.
• Experience with SIEM and EDR platforms.

Responsibilities

• Lead investigation and response of major incidents (ransomware, phishing, breaches).
• Perform triage, containment, eradication, recovery, and post-incident activities.
• Analyze alerts, logs, network traffic, endpoint telemetry, cloud activity, threat intel.
• Coordinate response with cybersecurity, infrastructure, legal, privacy, and vendors.
• Develop and optimize incident response playbooks and runbooks.
• Design automation and SOAR workflows to improve efficiency.

Skills

SOC operations

Incident response

Threat detection

Log analysis

Threat hunting

Automation / SOAR

Playbooks / runbooks

Cross-team coordination

Security tooling

Scripting (KQL/SPL/Python/PowerShell/B

Education

Bachelor's degree in Cybersecurity or related field

Tools

Microsoft Sentinel

Splunk

QRadar

Elastic Stack

LogRhythm

Microsoft Defender

CrowdStrike

SentinelOne

Carbon Black

Job description

Job Description

We are seeking a Senior Security Incident Responder who will be responsible for leading the investigation, containment, eradication, and recovery of cybersecurity incidents across the enterprise. This role serves as a technical leader during major security incidents, leveraging security monitoring tools, threat intelligence, forensic techniques, and advanced analytics to determine attack scope, impact, root cause, and remediation actions.

The role requires strong expertise in security operations, incident response, threat detection, log analysis, and security tooling, as well as the ability to coordinate response activities across technical teams, business stakeholders, legal, privacy, compliance, and third‑party vendors. The individual will also drive continuous improvement of SOC capabilities through playbook development, automation, detection tuning, and response orchestration.

• Lead the investigation and response of major cybersecurity incidents, including ransomware, phishing, insider threats, malware, credential compromise, and data breaches.
• Perform incident triage, analysis, containment, eradication, recovery, and post‑incident activities.
• Conduct root cause and impact analysis to identify attack vectors, affected systems, and business impact.
• Analyze security alerts, logs, network traffic, endpoint telemetry, cloud activity, and threat intelligence to determine the scope of incidents.
• Utilize SIEM, EDR, NDR, cloud security, email security, and identity security tools to investigate and respond to security events.
• Correlate data from multiple security technologies to identify malicious activity, reconstruct attack timelines, and uncover threat actor behavior.
• Perform threat hunting activities and identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs).
• Serve as the technical lead during major incidents and coordinate response efforts across cybersecurity, infrastructure, cloud, application, legal, privacy, compliance, and business teams.
• Provide clear incident communications, status updates, executive briefings, and ensure proper documentation and regulatory reporting.
• Develop, maintain, and optimize incident response playbooks, runbooks, and standard operating procedures.
• Design and implement automation and SOAR workflows to improve investigation efficiency, response consistency, and SOC effectiveness.
• Create and improve detection rules, use cases, and response processes while driving continuous improvements through lessons learned, threat intelligence, and incident trend analysis.

Skills and Requirements

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or related field.
• 10+ years of experience in cybersecurity, including significant experience in Security Operations Center (SOC) and Incident Response functions.
• Proven experience leading investigations of major cybersecurity incidents and security breaches.
• Strong understanding of incident response methodologies, attacker tactics, and forensic investigation techniques.
• Experience working in enterprise or global environments with complex security infrastructures.
• Ability to coordinate technical and non‑technical stakeholders during high‑pressure incident situations.
• Experience working in one of the SIEM platforms (Microsoft Sentinel, Splunk, QRadar, Elastic, LogRhythm, etc.)
• Experience working in one of the Endpoint Detection and Response platforms (Microsoft Defender, CrowdStrike, SentinelOne, Carbon Black, etc.)
• Experience with query languages and scripting (KQL, SPL, Python, PowerShell, Bash/Shell scripting)
• Experience with API integrations and workflow automations

Preferred Certifications:

• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Enterprise Defender (GCED)
• CISSP
• Certified SOC Analyst (CSA)
• Microsoft Security Operations Analyst Associate
• SANS Incident Response training or equivalent

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to [e-mail].