T&T | Cyber: D&R | Assistant Manager | Incident Response & Handling | Delhi

The Team

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient—not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks. Lear more about Cybersecurity

Your work profile

The role requires strong hands-on capability across incident response and digital investigations, with experience in multiple evidence domains such as endpoint, network, identity, cloud, and malware-related analysis. You will be expected to identify adversary tactics, techniques, and procedures; conduct structured forensic analysis; perform threat hunts across enterprise telemetry; and translate findings into clear technical and executive-ready outputs. You will also plan and manage assigned investigation workstreams, guide junior analysts, review investigation outputs, contribute to detection improvement, assist in building repeatable investigation workflows, and help clients strengthen their overall cyber response maturity. 

Key skills required

• Lead and support incident response and compromise assessment workstreams across endpoint, network, identity, cloud, and enterprise log sources. 
• Plan and manage assigned investigation workstreams, including task allocation, timeline tracking, evidence-quality review, issue escalation, stakeholder coordination, and review of client deliverables. 
• Conduct advanced threat hunting to identify adversary access, persistence, privilege escalation, lateral movement, command execution, defence evasion, credential access, data staging, and exfiltration activity. 
• Perform malware triage and behavioural analysis to identify execution flow, persistence mechanisms, command-and-control indicators, payload behaviour, affected systems, and likely impact. 
• Support malware reverse engineering activities where relevant experience is available, including static and dynamic analysis, string analysis, sandbox execution, API review, unpacking support, and behavioural reporting. 
• Perform forensic triage of Windows and Linux systems, including review of event logs, registry artefacts, prefetch, Shimcache, Amcache, SRUM, scheduled tasks, services, WMI, PowerShell logs, Shellbags, browser artefacts, and process execution evidence. 
• Analyse EDR, SIEM, firewall, proxy, VPN, DNS, email, cloud, and identity logs to reconstruct attacker activity and validate the scope of compromise. 
• Investigate suspicious authentication activity, Kerberos abuse, privileged account misuse, token abuse, delegation issues, Active Directory group changes, lateral movement indicators, and identity-based attack paths. 
• Conduct network-level analysis using packet captures, Zeek logs, DNS logs, proxy logs, firewall logs, and flow data to identify beaconing, tunnelling, unusual data transfers, and command-and-control activity. 
• Develop and refine threat-hunting hypotheses based on threat intelligence, observed indicators, MITRE ATT&CK techniques, suspicious behaviours, and client-specific risk scenarios. 
• Develop and tune SIEM or EDR queries, threat-hunting logic, detection rules, and custom analytics. Contribute to the development of Sigma and YARA rules where applicable.
• Use a combination of industry-standard investigation tools, which may include Velociraptor, KAPE, Eric Zimmerman tools, Volatility, Wireshark, Zeek, Timesketch, Plaso, YARA, Sigma, Ghidra, x64dbg, PEStudio, CyberChef, Sysinternals, and comparable utilities.
• Prepare and review structured investigation notes, malware analysis reports, threat-hunt summaries, timelines, evidence maps, root cause analysis inputs, and remediation recommendations.
• Map observed activity to MITRE ATT&CK and support detection engineering, control validation, purple-team outputs, and breach and attack simulation scenarios where relevant.
• Review investigation outputs prepared by junior team members and ensure technical accuracy, evidence traceability, completeness, and clarity of reporting.
• Mentor junior analysts during investigations, evidence review, log analysis, tool usage, and report drafting. 
• Support incident response lab development, secure malware analysis environments, telemetry onboarding, investigation automation, and repeatable response workflows.
• Work with client stakeholders to explain technical findings, validate evidence, evaluate containment options, and recommend practical remediation actions, while recognising that final containment and business decisions remain with the client.
• Track investigation risks, dependencies, evidence gaps, and critical decisions, and escalate material issues to engagement leadership in a timely manner.

Required Knowledge

• Four to seven years of relevant cybersecurity experience, including strong hands-on experience in incident response, digital forensics, threat hunting, SOC investigations, malware analysis, or compromise assessment.
• Demonstrated experience in leading defined technical workstreams, coordinating investigation activities, reviewing outputs, or guiding junior team members
• Strong understanding of attacker techniques across initial access, execution, persistence, privilege escalation, defence evasion, credential access, discovery, lateral movement, command and control, collection, and exfiltration.
• Practical experience in endpoint investigation using EDR telemetry, forensic artefacts, system logs, process lineage, registry artefacts, scheduled tasks, services, PowerShell activity, WMI, and suspicious binary execution.
• Working knowledge of malware triage concepts, including static and dynamic analysis, sandboxing, persistence mechanisms, suspicious process behaviour, droppers, loaders, fileless techniques, and command-and-control behaviour.
• Experience with malware unpacking, process injection analysis, memory forensics, reverse engineering, and detailed API-level analysis is desirable
• Experience with threat hunting across SIEM, EDR, DNS, proxy, firewall, VPN, email, cloud, and identity telemetry.
• Strong understanding of Windows security events, authentication logs, PowerShell logs, Sysmon logs, Windows artefacts, and common forensic evidence sources.
• Good understanding of Active Directory and identity security concepts, including Kerberos, NTLM, LDAP, delegation, privileged groups, trusts, domain controllers, Active Directory Certificate Services, and lateral movement techniques.
• Experience with network investigation concepts, including DNS analysis, HTTP and HTTPS traffic review, beaconing patterns, unusual egress, protocol misuse, tunnelling, and packet capture analysis.
• Ability to develop or tune SIEM and EDR queries, threat-hunting logic, and detection rules.
• Experience developing Sigma rules, YARA rules, or equivalent detection content is desirable
• Scripting capability using Python, PowerShell, Bash, APIs, or log-parsing methods to support investigations and automation.
• Ability to produce and review clear forensic summaries, malware triage notes, threat-hunt findings, timelines, technical reports, and remediation recommendations.
• Ability to manage evidence gaps, conflicting indicators, investigation dependencies, and technical uncertainties in a structured manner
• A Bachelor’s or Master’s degree in Computer Science, Information Security, Cybersecurity, Engineering, Digital Forensics, or a related discipline is preferred