Cyber
Deloitte Cyber understands the unique challenges and opportunities businesses face in cybersecurity. Join our team to deliver powerful insights to help our clients navigate the ever-changing threat design, and technology as we partner with clients to transform finance.
Position Summary
Level: Solution Advisor
Work you’ll do:
Incident Response & Management
- Lead initial response activities for security incidents including malware infections, ransomware attacks, data breaches, and insider threats
- Perform rapid triage and containment to minimize business impact and prevent incident escalation
- Execute forensic analysis on compromised systems, networks, and cloud environments
- Document incident timelines, indicators of compromise (IoCs), and attack methodologies
- Coordinate with client IT teams to implement remediation measures and restore normal operations
Technical Analysis & Investigation
- Conduct log analysis across SIEM platforms, EDR tools, firewalls, and cloud security logs
- Analyze network traffic captures (PCAP) to identify malicious activity and data exfiltration
- Perform memory and disk forensics on Windows, Linux, and macOS systems
- Reverse engineer malware samples to understand threat actor tactics, techniques, and procedures (TTPs)
- Correlate findings with threat intelligence to identify broader campaign patterns
Client Engagement & Communication
- On-call responsibilities including primary responder for critical incidents with expectation of rapid response (30-60 minutes) for major incidents.
- Serve as primary technical point of contact during active incidents
- Provide clear, concise status updates to client stakeholders at various technical levels
- Prepare incident reports and post-incident reviews with actionable recommendations
- Participate in tabletop exercises and incident response plan development
- Deliver knowledge transfer sessions to enhance client internal capabilities
Proactive Security Services
- Conduct threat hunting exercises to identify hidden threats in client environments
- Perform security assessments of incident response readiness and capabilities
- Review and provide feedback on client security monitoring and detection rules
- Stay current on emerging threats, vulnerabilities, and attack techniques
- Contribute to internal knowledge base and playbook development
The Team:
Cyber Defense & Resilience teams help clients defend against sophisticated threats by transforming security operations, leveraging technology, data analytics, and threat intelligence for continuous monitoring and rapid incident response. They manage dynamic attack surfaces and support business continuity through services such as operational resilience, crisis and incident response, and security operations center transformation.
Resilience as a Practice focuses on preparing organizations to anticipate, withstand, and recover from disruptions—including cyberattacks, natural disasters, and operational failures—by embedding resilience into processes, technology, and culture. Deloitte’s Resilience Team combines technical, operational, and strategic expertise to deliver integrated solutions for business continuity, disaster recovery, and risk management, ensuring organizations meet regulatory demands and maintain stakeholder trust during crises.
Qualifications
Must Have Skills/Project Experience/Certifications:
- 3-5 years of hands-on experience in cybersecurity, with at least 2 years focused on incident response
- Direct experience responding to ransomware, business email compromise, or advanced persistent threats
- Demonstrated experience working with enterprise clients in a consulting
- Proficiency with forensic tools (Magnet Axiom, EnCase, FTK, Volatility, X-Ways, Autopsy, etc.)
- Experience with EDR/XDR platforms (CrowdStrike, SentinelOne, Microsoft Defender, Carbon Black, etc.)
- Strong understanding of SIEM platforms (Splunk, QRadar, Azure Sentinel, Chronicle, etc.)
- Hands-on experience with network analysis tools
- Knowledge of threat intelligence platforms and frameworks (MITRE ATT&CK, STIX/TAXII)
- Scripting capabilities in Python, PowerShell, or Bash for automation and analysis
Good to have (Certifications):
- GCIH (GIAC Certified Incident Handler)
- GCFA (GIAC Certified Forensic Analyst)
- GCIA (GIAC Certified Intrusion Analyst)
- CISSP or equivalent security certification
- Industry-specific certifications (CISA, CEH, OSCP) are advantageous
Education:
- Bachelor’s degree or higher in Computer Science, or equivalent experience.
Location:
- Hyderabad/Bangalore/Pune/Chennai