Incident Response Analyst - Pune Hinjewadi

Experience Required-

• Incident management, managing alerts end to end or incidents happening, Investigation & Analysis, remediation action to IT provider, Crisis Management Support, Automation Integration, Remediation & Containment
• Conduct detailed investigations into security alerts to determine the scope, impact, and root cause of incidents. Utilize Microsoft Defender, Sentinel, and Azure tools for analysis and incident management.
• Solid experience with

  Microsoft security technologies

  , especially Microsoft Defender XDR and Sentinel.
• Good to have- Certifications in incident response, such as

  GCIH

  ,

  GCFA

  ,

  GCIA

  , or similar.
• Good communication skills, able to engage with stakeholders at all levels in the organization

Key Responsibilities:

• Incident Command: Act as the Incident Commander during security incidents, ensuring timely and effective resolution of alerts triaged by the Managed Security Service Provider (MSSP).
• Investigation & Analysis: Conduct detailed investigations into security alerts to determine the scope, impact, and root cause of incidents. Utilize Microsoft Defender, Sentinel, and Azure tools for analysis and incident management.
• Remediation & Containment: Provide clear and actionable remediation and containment instructions to IT and relevant teams to mitigate and resolve security incidents. Ensure all stakeholders are aligned in restoring operations while preventing further escalation.
• Crisis Management Support: Support on crisis management during high-severity incidents, ensuring effective communication and status reporting.
• Automation Integration: Assist on automation and hyper-automation tools to improve incident response efficiency. Participate in design and implementation of automated workflows to accelerate threat detection, investigation, containment, and remediation processes.
• Incident Documentation: Maintain accurate incident records, including detailed timelines, incident impact assessments, and post-incident analysis reports. Ensure compliance with internal and regulatory requirements for incident documentation.
• Collaboration & Communication: Work closely with internal IT teams, external MSSP providers, and other stakeholders to ensure a coordinated response to incidents.
• Continuous Improvement: Conduct post-incident reviews to identify lessons learned and propose improvements to response processes. Work with the security operations team to enhance detection, investigation, and remediation capabilities.

These key responsibilities are peered with key technologies (and linked skills) that are used in the company environment:

• Microsoft Defender Suite

  (Endpoint, Identity, Office, Cloud Apps)

• Zscaler Technologies

  , including ZIA and ZPA

• Microsoft Sentinel

  and

  Azure Logic Apps

  (automation and orchestration)

• Nozomi

  (OT/IoT network visibility and threat detection)

Familiarity with API integrations, automation scripting (PowerShell, KQL), and incident enrichment techniques is highly desirable.

Interested Share cv on dhanashree.chitre@weareams.com