Engineer II - Cyber Incident Response

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Engineer II - Cyber Incident Response based in India. This is a mid-level cybersecurity role within a global Security Operations Center (SOC), focused on detecting, investigating, and responding to cyber threats. You will analyze complex security alerts, logs, and forensic evidence to understand the scope and impact of incidents. The role plays an important part in containing threats, minimizing business disruption, and strengthening organizational security. You will work closely with cyber defense, threat intelligence, vulnerability management, and forensics teams in a collaborative environment. You will also contribute to improving incident response playbooks, processes, detection capabilities, and security tooling. The position offers an opportunity to deepen technical expertise while supporting and mentoring less experienced security professionals. This is a full-time, remote opportunity for candidates based in India. Investigate and respond to cybersecurity incidents, including phishing, malware, ransomware, unauthorized access attempts, and other security threats. Analyze security logs, alerts, endpoint data, and forensic artifacts to determine the nature, scope, severity, and potential business impact of incidents. Conduct detailed incident investigations using SIEM, EDR, network analysis, and forensic technologies. Support containment, eradication, and recovery activities to minimize the impact of security incidents and restore normal operations. Escalate complex or high-severity incidents to senior cybersecurity personnel, providing clear documentation, investigative evidence, and recommended actions. Develop, maintain, and continuously improve SOC playbooks, runbooks, standard operating procedures, and incident response processes. Collaborate with threat intelligence, vulnerability management, digital forensics, and other cyber defense teams to strengthen detection and response capabilities. Participate in post-incident reviews and lessons-learned activities, identifying opportunities to improve processes, tooling, and security controls. Support junior security analysts by sharing technical knowledge and providing guidance on investigative and incident response techniques. Apply established cybersecurity frameworks and incident response methodologies to investigations and operational activities. Maintain clear and accurate documentation of investigations, findings, escalations, and response actions. Operate effectively in a fast-paced environment where rapid analysis, sound judgment, and timely escalation are essential. Requirements Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related discipline, or equivalent professional experience. At least 2 years of experience in incident response, SOC operations, security operations, or a related technical cybersecurity field , with the broader profile ideally reflecting approximately 5+ years of progressive cybersecurity experience. Strong understanding of cybersecurity fundamentals, incident response methodologies, and common adversary tactics and techniques. Hands-on experience with security technologies such as SIEM, EDR, and forensic tools , with experience using platforms such as Splunk, CrowdStrike, or Wireshark preferred. Demonstrated ability to investigate and correlate logs, alerts, endpoint information, network activity, and other artifacts. Solid proficiency in at least one primary technical cybersecurity area, such as endpoint forensics, together with working knowledge of an adjacent discipline such as cloud security. Familiarity with recognized cybersecurity and incident response frameworks, including NIST, MITRE ATT&CK, and ISO 27035 . Strong analytical, investigative, critical-thinking, and problem-solving abilities, with the capacity to make sound decisions during high-pressure incidents. Excell