SOC- Incident Response

10+ years of experience in SOC services including incident response, digital investigation, SOC escalation, malware analysis, or security operations.. Need some senior candidates with Architect experience., * Serve as an L3 incident response specialist supporting security incidents, escalations, investigations, containment coordination, and post-incident improvement.

• Work with Client SOC, infrastructure, application, IAM/PAM, cloud, network, legal, risk, and relevant third parties during security incidents.
• Provide subject-matter expertise on complex or high-severity incidents while maintaining clear evidence, timelines, stakeholder updates, and recommendations.
• Lead or support investigation of high-severity security incidents across endpoint, identity, network, cloud, email, application, and data environments.
• Perform alert validation, scoping, timeline reconstruction, root-cause analysis, impact assessment, and evidence preservation.
• Develop containment, eradication, and recovery recommendations; coordinate execution with technology owners rather than assuming infrastructure remediation ownership unless explicitly authorized.
• Manage technical war-room activities, investigation workstreams, action tracking, and escalation to Customer incident command.
• Prepare executive summaries, detailed investigation reports, lessons learned, and post-incident corrective-action recommendations.
• Maintain incident response plans, playbooks, escalation matrices, communication templates, and evidence-handling procedures.
• Coordinate with threat intelligence, threat hunting, detection engineering, vulnerability management, and external forensic providers.
• Support tabletop exercises, readiness assessments, simulation exercises, and continuous improvement of incident-response processes.

• Strong understanding of incident response lifecycle, cyber kill chain, MITRE ATT&CK, NIST incident-handling practices, and evidence management.
• Hands-on experience investigating Windows, Linux, Active Directory, Entra ID, AWS, Azure, network, endpoint, email, and application security incidents.
• Experience with SIEM platforms such as Splunk, EDR/XDR platforms, network telemetry, cloud logs, identity logs, and forensic tools.
• Ability to write advanced SPL or equivalent queries for investigation, correlation, and timeline construction.
• Experience analyzing phishing, account compromise, malware, ransomware, insider threat, privilege misuse, data exfiltration, web attacks, and cloud compromises.
• Knowledge of memory, disk, endpoint, network, and log forensics; familiarity with malware triage and sandbox analysis.
• Experience using ServiceNow or similar case-management platforms for incident workflow, evidence, status, and SLA tracking.
• Strong knowledge of regulatory, audit, legal-hold, and financial-services incident-reporting considerations.
• Ability to automate analysis or enrichment using Python, PowerShell, APIs, SOAR, or scripting is preferred.