3,556 Incident Response jobs in India

ISA is a premier technology solution provider for the Aviation industry. We are backed by Air Arabia and headquartered in Sharjah, UAE.

Location: Pune

ISA is a premier technology solution provider for the Aviation industry. We are a subsidiary of Air Arabia Airlines. We have proven our expertise and proficiency over the years and have attracted scores of prestigious clients around the world. We are headquartered in Sharjah – UAE, while the Research and Development center is located in Colombo, Sri Lanka. We are a 100% owned subsidiary of Air Arabia

1. Monitor security events and alerts from various security tools such as SIEM (Security Information and Event Management), IDS/IPS, firewalls, and endpoint protection systems.
2. Defending the organization’s IT infrastructure, networks, and data from cyber threats.
3. Identifying and analyzing potential security incidents, investigating alerts, providing incident response, and escalating complex threats to senior security professionals.
4. Investigate security incidents, analyze the root cause, and respond to incidents in accordance with defined protocols.
5. Document security incidents, security breaches, and actions taken, ensuring compliance with internal procedures and industry standards.
6. Identify potential security breaches and take necessary actions to prevent them.
7. Collaborate with other IT teams to ensure that all systems are running smoothly and to resolve cross-functional issues.
8. Continuously assess and enhance monitoring, detection, and incident response processe

• 3 years of experience in a Security Operations Center or cybersecurity role.
• Familiarity with security technologies such as SIEM tools, firewalls, intrusion detection/prevention systems (IDS/IPS), and endpoint security platforms.
• Experience in incident detection, investigation, and response.
• Strong understanding of common security vulnerabilities, attack techniques, and defensive technologies.
• Familiarity with security standards and frameworks (NIST, CIS, ISO 27001, etc.).
• Good communication skills and the ability to work in a team environment.
• Strong problem-solving skills and attention to detail.
• Willingness to work flexible hours, including weekends and holidays, and be on-call as required.

Why Join Us?

• Work on innovative airline IT products used globally.
• Collaborative, growth-oriented team culture.
• Opportunities to learn aviation domain knowledge and cutting-edge QA practices.
• Competitive salary and benefits package.

Please send resumes to

SIEM Admin**:

I. Deploy, configure, and maintain SIEM solutions (e.G., Splunk, IBM QRadar, ArcSight).

II. Monitor and analyze security events and alerts from the SIEM system.

III. Tune SIEM rules, filters, and use cases to reduce false positives and improve detection accuracy. IV. Integrate log sources and data feeds into the SIEM system.

V. Develop and implement SIEM dashboards and reports.

VI. Perform regular health checks and maintenance on the SIEM infrastructure.

VII. Work with other security team members to investigate and respond to security incidents.

VIII. Stay updated on the latest threats, vulnerabilities, and SIEM technologies. IX. Document configurations, processes, and procedures.

SOC Admin**:

I. Manage and maintain SOC infrastructure, including servers, network devices, and security tools. II. Ensure the availability and performance of SOC tools and technologies (e.G., SIEM, IDS/IPS, firewalls).

III. Perform regular system updates, patches, and backups.

IV. Monitor the SOC environment for hardware and software issues and resolve them promptly.

V. Support the SOC team in incident detection, analysis, and response.

VI. Develop and maintain SOC documentation, including configurations, processes, and procedures.

VII. Collaborate with IT and other security teams to enhance the overall security posture.

VIII. Stay updated on the latest security technologies and best practices.

IX. Assist in the development and implementation of SOC policies and procedures.

Detection and Response Analyst - Rapid7 MDR (SOC 24 x 7)

Rapid7 is seeking passionate Detection and Response Analysts to join our Managed Detection and Response (MDR) team. In this role, you'll utilize Rapid7's advanced tools and threat intelligence to investigate and triage high-priority security events across diverse customer environments.

About the Role

As a core member of our 24/7/365 Security Operations Center (SOC), you will:

• Investigate Malicious Activity: Conduct in-depth investigations into various threats, from account compromises to complex zero-day exploits, on workstations, servers, and in the cloud.
• Generate Incident Reports: Document investigations using the MITRE ATT&CK Framework , including forensic, malware, and root-cause analysis.
• Collaborate and Communicate: Work closely with Customer Advisors on findings and recommendations, and with fellow analysts to share threat intelligence and best practices.
• Enhance Detections: Provide continuous feedback to our Threat Intelligence and Detection Engineering team to improve detection capabilities.

What You'll Bring

We're looking for individuals with:

• Strong understanding of Windows, MacOS/Darwin, and Linux operating systems .
• Fundamental knowledge of threat actor tactics (e.G., lateral movement, privilege escalation, persistence).
• Practical experience with CTF/HTB challenges and penetration testing tools (e.G., Mimikatz, Metasploit).
• Hands-on experience with forensic artifact and/or malware sample analysis .
• A passion for continuous learning, strong collaboration skills, and a customer-centric approach.

Why Rapid7?

Rapid7 is dedicated to creating a secure digital world. We foster a dynamic and collaborative environment where you can grow your career, push cybersecurity boundaries, and help protect our 10,000+ global customers from emerging threats.

Hi,

As the Information Security Senior Global Incident Response Analyst , you will play a critical role in the organization's cybersecurity efforts. The position is responsible for acting as a senior analyst during security incidents, coordinating efforts with various members of the Incident Response Team, ensuring Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. This position will work closely with business owners, IT teams, Privacy/Legal, and other members of the Information Security Team to protect the confidentiality, integrity, and availability of the organization's data and systems.

In this role, you will be responsible for the following:

• Incident Response Command
• Participate and occasionally lead the response to high-impact cybersecurity incidents.
• Coordinate cross-functional teams globally to ensure timely containment, eradication, and recovery.
• Act as a first-level decision-maker during incidents, escalating to Managers/Directors, coordinating with InfoSec Comms, and following established response protocols.
• Process & Procedure Improvement
• Develop, maintain, and continuously improve global incident response playbooks, runbooks, and workflows.
• Participate in regular incident simulations and tabletop exercises to evaluate and enhance response readiness.
• Analyze incident post-mortems to identify root causes and implement corrective actions.

At a minimum, we would like you to have:

• Bachelor’s degree in information security, Information Technology, Computer Science, or a related field or equivalent work experience.
• Proven experience (5 years) in cybersecurity (operations, vulnerability management, engineering, or related roles) with at least 1 year of experience coordinating incident response actions/activities
• Advanced knowledge of security concepts and principles
• Experience coordinating global, cross-functional teams in high-pressure situations
• Excellent communication and stakeholder management skills
• Familiarity with common security tools such as SIEM, EDR, forensics, and incident management platforms
• Strong analytical and problem-solving skills.
• Robust attention to detail.
• Obtain relevant certifications such as CompTIA Security+, Certified Information Systems Security Professional (CISSP), etc.

Career Development:

• This position serves a mid-level individual contributor role in information security. As the Senior Global Incident Response Analyst gains experience and certifications, they can advance to higher-level roles such as Incident Response Lead and/or Manager. Continuing education and professional development are essential for career growth in this field.

Hi,

As the Information Security Senior Global Incident Response Analyst , you will play a critical role in the organization's cybersecurity efforts. The position is responsible for acting as a senior analyst during security incidents, coordinating efforts with various members of the Incident Response Team, ensuring Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. This position will work closely with business owners, IT teams, Privacy/Legal, and other members of the Information Security Team to protect the confidentiality, integrity, and availability of the organization's data and systems.

In this role, you will be responsible for the following:

• Incident Response Command
• Participate and occasionally lead the response to high-impact cybersecurity incidents.
• Coordinate cross-functional teams globally to ensure timely containment, eradication, and recovery.
• Act as a first-level decision-maker during incidents, escalating to Managers/Directors, coordinating with InfoSec Comms, and following established response protocols.
• Process & Procedure Improvement
• Develop, maintain, and continuously improve global incident response playbooks, runbooks, and workflows.
• Participate in regular incident simulations and tabletop exercises to evaluate and enhance response readiness.
• Analyze incident post-mortems to identify root causes and implement corrective actions.

At a minimum, we would like you to have:

• Bachelor’s degree in information security, Information Technology, Computer Science, or a related field or equivalent work experience.
• Proven experience (5 years) in cybersecurity (operations, vulnerability management, engineering, or related roles) with at least 1 year of experience coordinating incident response actions/activities
• Advanced knowledge of security concepts and principles
• Experience coordinating global, cross-functional teams in high-pressure situations
• Excellent communication and stakeholder management skills
• Familiarity with common security tools such as SIEM, EDR, forensics, and incident management platforms
• Strong analytical and problem-solving skills.
• Robust attention to detail.
• Obtain relevant certifications such as CompTIA Security+, Certified Information Systems Security Professional (CISSP), etc.

Career Development:

• This position serves a mid-level individual contributor role in information security. As the Senior Global Incident Response Analyst gains experience and certifications, they can advance to higher-level roles such as Incident Response Lead and/or Manager. Continuing education and professional development are essential for career growth in this field.