Requisition Id: 1676761

As a global leader in assurance, tax, transaction and advisory services, we hire and develop the most passionate people in their field to help build a better working world. This starts with a culture that believes in giving you the training, opportunities and creative freedom. At EY, we don't just focus on who you are now, but who you can become. We believe that it’s your career and ‘It’s yours to build’ which means potential here is limitless and we'll provide you with motivating and fulfilling experiences throughout your career to help you on the path to becoming your best professional self.

The opportunity : Consultant-National-Forensics-ASU - Forensics - Investigations & Compliance - Gurgaon

National :

National comprises of sector agnostic teams working across industries for a well rounded experience.

ASU - Forensics - Investigations & Compliance :

Successful organizations depend on their reputation for keeping promises, respecting laws and behaving ethically to maintain stakeholder trust. EY Forensic & Integrity Services professionals help organizations protect and restore enterprise and financial reputation. We assist companies and their legal counsel to investigate facts, resolve disputes and manage regulatory challenges. We put integrity at the heart of compliance programs to help better manage ethical and reputational risks.

Our integrated approach ranges from enhancements in areas of perceived weakness or issues — including governance, controls, culture and data insights — to full organizational design and structural implementation. We want to help companies safeguard and restore financial and brand reputations. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over.

Your key responsibilities

Technical Excellence

• Job Role Description- DFIR Analyst DFIR Analyst is responsible for investigating security incidents, analysing digital evidence and helping in containment and remediation of cyber security incident. The Analyst should be having experience on hands-on investigations, triage, evidence collection and documentation of complex cyber security incidents. 1. Primary Responsibilities (a) Incident Triage and Initial Response Activities
• Understand the incident details, impact and infrastructure.
• Determine the potential source of data useful for conducting the investigation.
• Conduct assessment of security alerts through log data collected through SIEM, EDR, SOAR, IDS/IPS, email security, etc or directly accessing the log sources.
• Validate the malicious activities and corelate the events to recreate the attack vector.
• Perform initial containment actions (e.g., isolating endpoints, blocking IOCs).
• Create a Triage report and explain the findings to the client. (b) Digital Forensics and Evidence Handling
• Acquire forensic images (disk, memory) using approved tools such as FTK, Encase, Kali Linux etc.
• Collect logs and volatile data safely and minimize evidence contamination.
• Maintain strict chain-of-custody documentation.
• Extract artifacts from: o Windows Event Logs o Registry o Prefetch, LNK files o Browser artifacts o File metadata o EDR telemetry (c) Incident Investigation and Analysis
• Analyse endpoint activity to identify malicious processes, persistence, lateral movement and data exfiltration indicators.
• Perform malware triage (static analysis, sandboxing).
• Review suspicious emails attachments or URLs.
• Investigate and identify network-based attacks patterns.
• Identify root cause patient zero and attack methodology. (d) Threat Intelligence Use
• Enrich indicators (IPs, URLs, hashes, domains) using TI platforms.
• Map attacker behaviour to MITRE ATT&CK techniques.
• Provide early warning indicators for reporting and intimation of the client. (e) Reporting & Documentation
• Create detailed incident investigation reports.
• Document timelines, findings and corrective actions with recommendations. 2. Tools & Technology Knowledge: At Analyst level, the candidate is expected to work with: (a) Forensic Tools
• Autopsy / Sleuth Kit
• FTK Imager
• Cellebrite (if mobile involved)
• Volatility / Memory forensics tools
• Encase (b) Incident Response & EDR Platforms
• Microsoft Defender XDR
• CrowdStrike Falcon
• Sentinel One
• Carbon Black (c) SIEM / Log Analytics
• Splunk
• Elastic
• Microsoft Sentinel
• QRadar (d) Network & Malware Analysis Tools
• Wireshark
• KAPE
• NetFlow analysers
• Sandbox tools (Any.Run, Joe Sandbox)
• Open source like Virus Total and OTX 3. Required Skills and Competencies (a) Technical Skills
• Understanding of Windows and Linux internals.
• Knowledge of common attack techniques (phishing, ransomware, credential theft).
• Ability to read logs and identify anomalies.
• Basic scripting (PowerShell, Python) for automation.
• Familiarity with Active Directory concepts.
• Familiarity with Cloud platforms such as AWS and Azure
• Familiarity with well know log source. (b) Soft Skills
• Strong analytical and troubleshooting mindset.
• Clear communication during incident handling.
• Ability to work under pressure during high-severity events.
• Attention to detail for evidence handling and documentation. 4. Experience & Qualifications
• 0–3 years in cybersecurity, SOC, or DFIR.
• Bachelor’s degree in IT/CS or equivalent experience.
• Preferred certifications: o CompTIA Security+ o CompTIA CySA+ o GIAC GCIH / GCFA o CEH/ CHFI o Tool specific such as EnCE and FTK AccessData Certified Examiner, or in any SIEM tool related.

Skills and attributes

To qualify for the role you must have
Qualification

• Bachelor of Technology in Computer Science

Experience

• DFIR Investigation (2+ Years), SOC Operation (2+ years)

What we look for

People with the ability to work in a collaborative manner to provide services across multiple client departments while following the commercial and legal requirements. You will need a practical approach to solving issues and complex problems with the ability to deliver insightful and practical solutions. We look for people who are agile, curious, mindful, and able to sustain positive energy, while being adaptable and creative in their approach.

What we offer

Fuelled by the brilliance of our people, EY has emerged as the strongest brand and the most attractive employer in our field, with market-leading growth over competitors. Our people work side-by-side with market-leading entrepreneurs, game-changers, disruptors, and visionaries. As an organization, we are investing more time, technology, and money than ever before in skills and learning for our people. At EY, you will have a personalized Career Journey and also the chance to tap into the resources of our career frameworks to better know about your roles, skills, and opportunities.

EY is equally committed to being an inclusive employer, and we strive to achieve the right balance for our people—enabling us to deliver excellent client service while allowing our people to build their careers as well as focus on their wellbeing.

If you can confidently demonstrate that you meet the criteria above, please contact us as soon as possible.

Join us in shaping the future with confidence. Apply Now