T&T | Cyber: D&R | Analyst | Incident Response & Handling | Delhi

The Team

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Learn more about Cybersecurity

Your work profile

As a Consultant in our Cyber team, you will support incident response, threat hunting, compromise assessment, malware triage, and digital forensics engagements. You will work under the guidance of experienced team members to collect and review evidence, analyse security events, document findings, and contribute to clear, evidence-based investigation outputs.The role requires foundational knowledge of incident response processes, including triage, scoping, evidence collection, containment support, eradication, recovery, root cause analysis, and lessons learned. The individual should be comfortable learning in time-sensitive situations and collaborating with SOC, engineering, identity, cloud, and infrastructure teams.

Key Skills Required

• Support incident response activities, including initial triage, evidence collection, event validation, scoping support, containment tracking, recovery support, and post-incident documentation.
• Review security events using evidence sources such as EDR telemetry, SIEM alerts, Windows event logs, Sysmon, identity logs, cloud audit logs, network telemetry, mailbox artefacts, and SaaS evidence under appropriate guidance.
• Assist in correlating available evidence to understand the source, impact, timeline, and potential scope of a security incident, and escalate findings to senior team members.
• Support investigations into phishing, credential compromise, suspicious authentication, malware execution, persistence, privilege abuse, lateral movement, and ransomware-related activity.
• Maintain accurate case notes, evidence trackers, investigation timelines, query records, and structured evidence trails to support technical analysis and reporting.
• Support incident bridge calls and technical discussions by maintaining action trackers, capturing key decisions, and preparing concise investigation updates.
• Collaborate with SOC, engineering, identity, cloud, and infrastructure teams to obtain evidence and support investigation activities.
• Support incident response assessments, simulations, playbook reviews, and after-action documentation.
• Contribute supporting evidence and analysis for root cause assessment, lessons learned, and resilience improvement recommendations.
• Actively participate in training, knowledge-sharing, lab exercises, and feedback sessions to develop technical investigation capability.
• Follow evidence-handling, confidentiality, documentation, and quality-review requirements throughout the engagement.
• Prepare clear investigation notes, evidence summaries, timelines, indicator lists, and draft technical findings for review by senior team members.
• Use investigation utilities such as CyberChef, Sysinternals, Wireshark, KAPE, Eric Zimmerman tools, Velociraptor, or comparable tools as appropriate to assigned tasks.
• Run approved SIEM, EDR, and threat-hunting queries and document results accurately; assist with query refinement under guidance.
• Support malware triage using file metadata, hashes, strings, sandbox results, process behaviour, persistence indicators, and identified network connections.
• Perform basic forensic triage of Windows and Linux systems, including review of event logs, registry artefacts, prefetch, scheduled tasks, services, PowerShell logs, browser artefacts, and process execution evidence under guidance
• Overall experience of 0 to 2 years in cybersecurity, including relevant internships, academic projects, lab work, SOC exposure, incident response, digital forensics, threat hunting, malware analysis, or security monitoring.

• Practical exposure to security monitoring or investigation through employment, internships, projects, labs, simulations, or academic work is preferred.
• Foundational knowledge of Windows, Linux, Active Directory, DNS, networking, authentication, and common enterprise security concepts.
• Familiarity with SIEM or EDR platforms such as QRadar, Microsoft Sentinel, CrowdStrike, Microsoft Defender, SentinelOne, or equivalent is desirable.
• Basic understanding of the MITRE ATT&CK framework, cyber kill chain, common attacker techniques, and incident response lifecycle.
• Awareness of evidence sources beyond dashboards, including endpoint artefacts, authentication logs, cloud logs, network evidence, and mailbox artefacts.
• Awareness of SOAR technologies, incident response playbooks, case-management workflows, and ITSM tools is desirable.
• Ability to work in time-sensitive situations with professionalism, curiosity, structured thinking, attention to detail, and willingness to seek guidance when required.
• Ability to document observations objectively, distinguish confirmed findings from hypotheses, and maintain evidence traceability.
• Familiarity with scripting or query languages such as Python, PowerShell, Bash, KQL, SPL, SQL, or regular expressions is desirable.
• Basic knowledge of network concepts, including TCP/IP, DNS, HTTP and HTTPS, common ports and protocols, proxies, firewalls, and packet capture analysis.
• Basic understanding of malware concepts such as hashes, strings, static and dynamic analysis, sandboxing, droppers, loaders, and command-and-control activity.
• Basic understanding of Windows event logs, PowerShell, Sysmon, processes, services, scheduled tasks, registry artefacts, and common persistence mechanisms.
• Bachelor’s / Master’s Degree
• Certifications like GCIH, GCFA, ECIH v2, CHFI, GCIA, SC-200, or equivalent are preferred.