Lead - Incident Response

Job Description

K8 - Incident Response Lead - Cyber Security Operations & Incident Response Specialist

Role

K8 - Incident Response Lead

Function

Cyber Security / SOC / Incident Response

Location

India (Bangalore and Kochin)

Experience

7+ yrs

Employment Type

Full-Time

Mandatory Certification

At least one current/valid certification listed below

Job Summary

We are looking for experienced cyber security professionals to strengthen our Security Operations, Incident Response, Threat Detection, Digital Forensics, and Cyber Defence teams. Candidates should have hands-on experience in one or more areas such as SOC operations, incident response, DFIR, threat hunting, SIEM/XDR engineering, or security operations and must hold at least one current and valid certification from the mandatory certification list below.

Mandatory Professional Certification

Candidates must hold at least ONE current/valid certification from the following:

• GCIH GIAC Certified Incident Handler
• GCFA – GIAC Certified Forensic Analyst
• GCFE – GIAC Certified Forensic Examiner
• OSCP – OffSec Certified Professional
• CISSP – Certified Information Systems Security Professional
• CISM – Certified Information Security Manager
• CREST certification relevant to the candidate’s cyber security specialization

This is a mandatory eligibility requirement. Candidates should be able to provide certification details and evidence of current status during the recruitment and onboarding process.

Key Responsibilities

• Monitor, investigate, triage, and respond to cyber security alerts and incidents.
• Perform incident analysis, containment, eradication, recovery, and root-cause analysis.
• Investigate alerts across SIEM, EDR/XDR, network, identity, cloud, and email security platforms.
• Conduct threat hunting and identify suspicious or malicious activity across enterprise environments.
• Support malware, phishing, ransomware, credential compromise, data-exfiltration, and unauthorized-access investigations.
• Perform digital forensic investigation and evidence analysis where required.
• Develop and maintain incident response playbooks, SOPs, runbooks, and escalation procedures.
• Collaborate with SOC analysts, incident responders, threat intelligence, vulnerability management, network, cloud, infrastructure, and application teams.
• Support detection-rule, correlation-use-case, dashboard, and security monitoring improvements.
• Maintain accurate incident documentation, investigation evidence, and operational reports.
• Participate in major-incident handling, escalation, and shift/on-call activities as applicable to the assigned role.

Required Technical Skills

Security Operations

• SOC monitoring, alert triage, event analysis, and escalation
• SIEM investigation, correlation, detection use cases, and dashboards

Incident Response & DFIR

• Incident handling, containment, eradication, and recovery
• Digital forensics, evidence collection, endpoint/network investigation, and threat hunting

Security Technologies

• Microsoft Sentinel, Splunk, QRadar, or equivalent SIEM platforms
• Microsoft Defender XDR, CrowdStrike Falcon, Palo Alto Cortex XDR, or equivalent EDR/XDR platforms
• Network security, firewall, NDR, identity security, cloud security, and forensic technologies

Automation

• KQL, SPL, PowerShell, Python, or equivalent query/scripting skills are desirable

Required Experience

• Relevant experience in SOC, Cyber Security Operations, Incident Response, DFIR, Threat Hunting, Security Engineering, or Cyber Defence.
• Hands-on experience investigating or responding to cyber security incidents is preferred.
• Experience in enterprise or Managed Security Services environments is desirable.
• Experience in BFSI or other regulated environments is an advantage.

Educational Qualification

Bachelor’s degree in Computer Science, Information Technology, Cyber Security, Engineering, or a related discipline is preferred. Relevant professional experience combined with the mandatory security certification may also be considered.

Soft Skills

• Strong analytical, troubleshooting, and problem-solving skills.
• Clear verbal and written communication.
• Ability to work effectively during critical incidents and under time pressure.
• Strong teamwork, ownership, and stakeholder-management skills.
• Ability to prepare clear technical documentation and investigation reports.

Certification Verification

Shortlisted candidates will be required to provide the certification name, issuing organization, certificate or credential number, and evidence that the certification is current/valid as part of the recruitment and onboarding verification process.

Mandatory Eligibility

Candidates who do not hold at least one current/valid GCIH, GCFA, GCFE, OSCP, CISSP, CISM, or relevant CREST certification will not meet the mandatory certification requirement for this position.