Incident Response Specialist
Cybersecurity - Incident Response · Gurugram, India · On-site · Full-time · 3–6 years of relevant cybersecurity experience
Invield is hiring an Incident Response Specialist with practical experience investigating data breaches, compromised accounts, application attacks, and server incidents. You will independently review clients’ existing investigations and root cause analyses, examine supporting evidence, reconstruct attack timelines, assess data exposure, and prepare technically defensible reports. The role also includes evidence collection, incident response support, remediation validation, and assistance with follow-up queries relating to client submissions to CERT-In. We are looking for someone who can distinguish confirmed findings from assumptions, identify gaps in evidence, and explain technical conclusions clearly. Candidates must have experience investigating real incidents and writing Incident reports; vulnerability scanning or penetration testing experience alone is insufficient.
What you'll do
- Review existing incident reports, internal RCAs, timelines, and supporting evidence to independently assess findings.
- Define investigation scope, evidence requirements, technical dependencies, and investigation limitations.
- Collect and preserve digital evidence using appropriate acquisition methods, hashing, evidence registers, and chain-of-custody records.
- Assess the provenance and integrity of client-provided evidence and document any gaps in historical handling records.
- Analyse authentication, WAF, web server, application, database, firewall, cloud, and EDR logs.
- Correlate events across sources, reconcile timestamps and time zones, and reconstruct evidence-backed attack timelines.
- Investigate account compromise, SQL injection, unauthorised database access, credential exposure, and suspected data exfiltration.
- Differentiate attempted attacks from successful execution and confirmed data theft from potential exposure.
- Examine Windows and Linux artifacts for malicious execution, persistence, privilege escalation, and lateral movement.
- Perform disk and memory analysis where evidence and investigation requirements justify it.
- Conduct malware triage and assess suspected ransomware activity, escalating advanced reverse engineering when required.
- Identify root causes and contributing control failures, supported by traceable evidence.
- Prepare forensic reports, RCA documents, evidence annexures, indicators of compromise, and management summaries.
- Support clients in preparing technical responses to CERT-In requests and subsequent clarification queries.
- Review corrective actions and safely validate relevant fixes within an authorised scope.
- Coordinate with application, database, infrastructure, security, and management teams throughout engagements.
- Maintain confidentiality and use approved methods for evidence access, storage, transfer, retention, and disposal.
What you'll bring
- 3–6 years of relevant cybersecurity experience, including at least 2 years of hands-on incident investigation work.
- Demonstrated involvement in real incident investigations, with responsibility for evidence analysis and report preparation.
- Practical experience reviewing existing RCAs and independently validating conclusions against supporting evidence.
- Strong understanding of digital evidence preservation, hashing, chain of custody, and forensic documentation.
- Hands-on knowledge of Windows and Linux forensic artifacts, authentication mechanisms, and operating system logs.
- Understanding of HTTP, web applications, SQL injection, database permissions, and database audit records.
- Ability to investigate data exposure and exfiltration while clearly documenting evidentiary limitations.
- Experience with relevant tools such as Velociraptor, KAPE, FTK Imager, Autopsy, Volatility, Plaso, or comparable forensic platforms.
- Working experience with SIEM searches, EDR investigations, and network traffic analysis.
- Ability to use Python, PowerShell, Bash, or SQL for evidence processing and investigation support.
- Strong technical writing skills, including preparation of clear findings, timelines, RCA reports, and evidence annexures.
- Familiarity with CERT-In incident reporting processes and handling technical requests relating to reported incidents.
- Bachelor’s degree in IT, Computer Science, Cybersecurity, Digital Forensics, or a related discipline; equivalent relevant experience may be considered.
- GCFA, GCFE, GCIH, CHFI, EnCE, or other relevant certifications are preferred; demonstrated investigation capability is essential.
- Willingness to visit client locations and support urgent investigations outside regular hours when required and agreed.