Senior Incident Response Engineer in India at Jobgether

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Incident Response Engineer based in India.

This role offers the opportunity to join an elite cybersecurity team dedicated to helping organizations respond to and recover from complex cyber threats.
You will lead high-impact incident response engagements, guiding investigations, coordinating technical teams, and helping customers neutralize security breaches.
The position combines advanced threat analysis, digital forensics, customer communication, and strategic remediation planning.
You will work on critical cybersecurity incidents involving ransomware, business email compromise, and evolving attack techniques.
This is an ideal opportunity for an experienced security professional who thrives under pressure and enjoys solving complex problems.
You will collaborate with skilled analysts and global teams in a remote-first environment focused on innovation, knowledge sharing, and protecting organizations worldwide.

The Senior Incident Response Engineer will lead cybersecurity investigations, coordinate response activities, and provide expert guidance to customers facing security incidents. Key responsibilities include:

• Lead incident response engagements from initial assessment through containment, investigation, remediation, and final reporting.
• Conduct customer kickoff calls to understand security incidents, define priorities, and recommend immediate containment actions.
• Lead customer update meetings and provide clear communication on forensic findings, investigation progress, and remediation recommendations.
• Direct forensic investigations by prioritizing tasks, assigning activities to analysts, and ensuring effective incident resolution.
• Manage multiple incident response engagements simultaneously while maintaining quality, accuracy, and timely delivery.
• Analyze attacker tactics, techniques, and procedures (TTPs) and map findings to established threat intelligence frameworks.
• Perform root cause analysis to identify the origin, scope, and impact of security incidents, including potential data exposure.
• Produce executive-level incident reports summarizing investigation timelines, response actions, findings, and remediation guidance.
• Provide transition notes and knowledge sharing across teams working in different time zones.
• Mentor junior analysts, support team development, and contribute to improving incident response processes and capabilities.
• Participate in service improvement initiatives, including projects that enhance response methodologies and operational effectiveness.

The ideal candidate is an experienced cybersecurity professional with strong incident response expertise, excellent communication skills, and the ability to manage complex security investigations. Required qualifications and skills include:

• 5+ years of experience leading incident response investigations, particularly involving ransomware incidents.
• Experience managing business email compromise (BEC) investigations and other complex cybersecurity incidents.
• Strong understanding of incident response processes, cyber risk assessment, threat mitigation, and security best practices.
• Proven ability to lead investigations, coordinate technical teams, and drive successful threat containment and remediation.
• Solid knowledge of the MITRE ATT&CK framework and attacker behaviors.
• Strong analytical and problem-solving skills with the ability to make decisions under pressure.
• Excellent verbal and written communication skills, including the ability to explain technical findings to executive-level stakeholders.
• Ability to manage multiple priorities, delegate tasks effectively, and work independently in high-pressure situations.
• Willingness to work flexible hours, including occasional weekends, holidays, or extended hours when required for customer engagements.
• Post-secondary education in cybersecurity or a comparable technical discipline.
• Cybersecurity certifications such as CISSP, GCFA, or similar credentials are considered an advantage.
• Experience with SIEM technologies such as Splunk, ELK, or equivalent platforms is a plus.
• Familiarity with SQL queries and scripting languages such as PowerShell, Python, or Bash is beneficial.

• Remote-first working environment with flexibility to work from home.
• Opportunity to work on advanced cybersecurity challenges and protect organizations against evolving threats.
• Collaboration with experienced security professionals across global teams.
• Employee-led diversity and inclusion communities supporting connection and professional growth.
• Wellbeing initiatives including dedicated wellbeing days, webinars, and health-focused programs.
• Fitness, learning, and engagement activities designed to support employee development and team connection.
• Opportunities to contribute to cybersecurity innovation and improve incident response practices.
• Community involvement opportunities through charity initiatives and employee volunteer programs.
• Supportive culture focused on