Job Overview
Fourth Command is looking for an experienced Digital Forensics and Incident Response (DFIR) Specialist to join its cybersecurity team in a senior technical role. This position is designed for a professional with 5–8 years of hands-on experience in digital forensics, incident response, threat hunting, and advanced security investigations across enterprise, cloud, and hybrid environments.
Key Responsibilities
- Lead and manage end-to-end digital forensics and incident response investigations, including scoping, evidence strategy, data acquisition, analysis, findings validation, and remediation support across endpoints, servers, networks, cloud platforms, and mobile devices.
- Perform advanced forensic analysis on disk images, memory dumps, log files, cloud artifacts, and other digital evidence to reconstruct attack timelines, identify persistence mechanisms, detect credential access, and assess data exposure or exfiltration.
- Conduct incident triage, containment recommendations, eradication support, and recovery coordination during active security incidents such as ransomware, APT activity, insider threats, data breaches, and large-scale compromises.
- Analyze malware samples using static and dynamic techniques, reverse engineer payloads when required, and extract indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) to support broader threat intelligence and detection efforts.
- Ensure proper evidence collection, preservation, and chain-of-custody documentation in line with legal, regulatory, and organizational requirements for forensic admissibility.
- Generate comprehensive incident reports, forensic findings documents, executive summaries, and technical briefings for internal stakeholders, leadership, and clients, ensuring clarity, accuracy, and actionable recommendations.
- Support the creation, maintenance, and continuous improvement of DFIR playbooks, standard operating procedures (SOPs), investigation templates, and best practices for the team.
- Act as a primary escalation point during major incidents, providing technical guidance, reviewing the work of junior and mid-level analysts, and ensuring high-quality deliverables across cases.
- Collaborate with SOC, threat intelligence, red team, legal, compliance, and engineering teams to enrich investigations, validate threats, improve detection rules, and strengthen overall incident readiness.
- Participate in tabletop exercises, incident simulations, and readiness drills to improve organizational preparedness and response effectiveness.
- Stay updated on emerging threats, new forensic techniques, tool advancements, and industry frameworks such as MITRE ATT&CK, NIST IR process, and incident lifecycle models.
Required Qualifications and Skills
- 5–8 years of hands-on experience in digital forensics, incident response, threat hunting, or advanced security operations within complex enterprise or consulting environments.
- Bachelor’s degree in BSc (IT), BSc (Cyber Security), BSc (Computer Science), BCA, MSc, MTech, or related technical fields. A minimum CGPA of above 7.0 is required in the qualifying degree.
- Strong expertise in forensic and incident response tools such as Magnet Axiom, EnCase, FTK Suite, X-Ways, Volatility, Autopsy, SleuthKit, Belkasoft, Cellebrite, XRY, Oxygen, MOBILedit, or similar platforms.
- Proficiency with EDR/XDR platforms such as CrowdStrike, SentinelOne, Carbon Black, Microsoft Defender for Endpoint, or similar tools for investigation and response activities.
- Solid understanding of Windows and Linux file systems, memory structures, registry artifacts, log sources, and common forensic artifacts used in investigations.
- Strong knowledge of malware behavior, attack techniques, and common threat actor TTPs, with practical experience in malware triage and analysis.
- Familiarity with industry frameworks and standards such as MITRE ATT&CK, NIST Incident Response (NIST SP 800-61), ISO/IEC 27001, and related security practices.
- Proven ability to lead incident investigations, manage cases end-to-end, review technical work, and mentor junior team members.
- Strong report-writing skills and the ability to communicate complex technical findings clearly to both technical and non-technical audiences.
- Ability to work under pressure, handle multiple high-priority incidents, and respond flexibly to urgent security situations as needed.
- Relevant certifications such as GCFA, GNFA, GCFE, GCIA, CISSP, CISM, CEH, OSCP, or similar are highly preferred.
Working Model
This is a full-time, senior technical role with Fourth Command and is suitable for candidates who are comfortable working in a high-responsibility, client-facing, and operationally demanding environment. The role may require on-call availability, incident response outside regular hours, and readiness to engage during critical security events.
The position is ideal for experienced professionals who want to lead complex DFIR engagements, contribute to strategic security improvements, and work in a fast-evolving cybersecurity landscape. The role demands strong technical discipline, structured investigation practices, and the ability to balance depth of analysis with timely delivery during incidents.
Mindset and Commitment
Fourth Command is looking for a DFIR Specialist who is technically strong, calm under pressure, and committed to delivering high-quality investigations and response outcomes. At this level of experience, the company expects a high degree of ownership, accountability, and the ability to independently manage complex cases with minimal supervision.
The ideal candidate should be detail-oriented, methodical, and passionate about understanding attacker behavior, uncovering root causes, and strengthening organizational resilience. Strong collaboration skills, professional communication, and a genuine interest in mentoring and elevating the team’s capabilities will be important for long-term success in this role.
This position is well suited for someone who wants to grow further in the DFIR domain, take on leadership responsibilities in incident handling and forensics, and contribute to building world-class incident response capabilities in a professional consulting environment.
Job Type: Full-time
Pay: ₹300,000.00 - ₹800,000.00 per year
Work Location: In person
