incident response specialist

BP Energy

<p><b>Entity: </b></p>Technology<p><br><b>Job Family Group: </b></p>IT&S Group<p><br><b>Job Description: </b></p><p>Our purpose is to deliver energy to the world, today and tomorrow. For over 100 years, bp has focused on discovering, developing, and producing oil and gas in the nations where we operate. We are one of the few companies globally that can provide governments and customers with an integrated energy offering  click apply for full job details

Cyber Security Incident Response (CSIRT) Specialist

ASMGi

<div><div>ASMGi - Cyber Incident Response Analyst</div>
<div><b>General Summary:</b></div>
<div>As a key member of ASMGi&rsquo;s Information Security Incident Response Team this individual will be responsible for various parts of the incident response process - detection, validation, containment, remediation, and communication - for IT based security events and incidents impacting ASMGi&rsquo;s clients.</div>
<div>This individual will be responsible for the rapid response and resolution of security incidents including the ASMGi MDR / MSOC plus client&rsquo;s environments. This will involve coordinating with teams including Legal, Security Operations and Forensics experts, internal or external, to identify root cause, restore services and communicate status to affected stakeholders.</div>
<div>This role will act as the escalation path for the ASMGi Operations Team to validate findings and identify scope of events and support during larger investigations. This individual will act as an internal and client facing resource while interacting with the third-party Security Operations Center as applicable.</div>
<div><b>Principal Accountabilities:</b></div>
<div><b>25% - Client Incident Response Onboarding and Program Development.</b></div>
<ul><li>Work with ASMGi MDR / MSOC plus Service clients as part of the overall service and specifically the Incident Response Program Development including Incident Response Policy, Incident Response Plan, and Incident Response Playbook development and adoption.</li>
<li>Conduct client Tabletop Exercises on an annual basis based on the adopted Incident Response Playbook as part of the ASMGi MDR / MSOC plus Incident Response Service.</li>
</ul><div><b>50% - Incident Response</b></div>
<ul><li>Perform Level 2 and Level 3 computer security incident response activities including coordinating with the Security Operations Center and Forensics experts, internal and external.</li>
<li>Analyze, track and triage anomalies that have been escalated to ensure appropriate identification of risk to ASMGi MDR / MSOC plus clients.</li>
<li>Oversee the forensic analysis of cybersecurity incidents impacting ASMGi MDR / MSOC plus clients.</li>
<li>Understand and research emerging threats and current trends that may impact customers along with mitigation/resolutions for such threats.</li>
<li>Communicate and coordinate response efforts including working with ASMGi MDR / MSOC plus client&rsquo;s I.T., Business Leaders, and Third Parties to mitigate the impact of the risk and provide a lead role as part of the ASMGi Computer Security Incident Response Team (CSIRT).</li>
<li>Prepare incident reports of analysis and methodology and results of investigation to be submitted to ASMGi MDR / MSOC plus clients.</li>
</ul><div><b>25% - Assist with Incident Management Strategy Development, Consulting and Management of Third-Party Security Operations Center.</b></div>
<ul><li>Leverage lessons learned, threat modeling and emerging industry better practice, to analyze the effectiveness of the existing program (policies, technology, and awareness) to continuously improve the Incident Management Program.</li>
<li>Review industry frameworks, emerging threats, and best practice to advance the ASMGi MDR / MSOC plus Service.</li>
<li>Partner with ASMGi partners and internal groups to improve the ASMGi MDR / MSOC plus service and capabilities.</li>
<li>Assist with management of third-party business relationships for the security operations center and service levels. Identify potential gaps including procedures needed to mitigate risk and assist with appropriate solutions.</li>
</ul><div><b>Job Complexity</b></div>
<ul><li>Appropriately balances security risk and business impact to ensure that ASMGi&rsquo;s use of detection/response controls are effective.</li>
<li>Ability to build operational processes using industry best-practice that are tailored to the ASMGi MDR / MSOC plus client&rsquo;s organization, system, and processes.</li>
<li>Ability to effectively communicate risk including corrective action plans/recommendations to non-technical audiences including the ASMGi MDR / MSOC plus client&rsquo;s Executives and the Board of Directors leveraging the MDR / MSOC plus service.</li>
<li>Ability to create effective reports and presentations tailored to different audiences to ensure transparency and understanding of the ASMGi MDR / MSOC plus Service.</li>
<li>Assist with development of MDR / MSOC plus Service roadmap.</li>
</ul><div><b>Job Specifications</b><br>
Minimum education required: Bachelor's Degree Required</div>
<div>Education desired: Bachelor of Science<br>
Years of relevant experience: 7 &ndash; 10 +</div>
<div><b>Knowledge, skills, and abilities required:</b></div>
<ul><li>High level of technical expertise in information security, including deep familiarity with relevant penetration and intrusion techniques and attack vectors.</li>
<li>Cybersecurity in large complex companies including knowledge of security and privacy breach laws and regulatory reporting.</li>
<li>Proven experience working with Security Operations Center services, forensics firms.</li>
<li>Demonstrated ability to lead and develop cohesive and collaborative management and operational teams internally and with a third-party.</li>
<li>Proven experience implementing policies, procedures, and technology to detect and recover from a cybersecurity attack.</li>
<li>Ability to demonstrate strong computer knowledge networks, desktops, servers, cloud, and software as a service technology.</li>
<li>Expertise with next generation firewalls, Endpoint Detection and Response, Microsoft Advanced Threat Protection, Azure, and Office 365, Zero Day Threat Detection Technology, Threat Intelligence Feeds, Forensics, Data Loss Prevention Software, Web Proxies, Web Application Firewalls.</li>
<li>Strong problem-solving and trouble-shooting skills.</li>
<li>Strong communication skills including writing reports and presenting to senior executives.</li>
<li>Demonstrated connections to external Incident Response leaders and learning organizations.</li>
</ul><div><b>Working Conditions</b></div>
<ul><li>Normal corporate office environment and remote / virtual based on COVID-19.</li>
<li>On call work is required.</li></ul></div>

Cyber Incident Response Analyst

Palo Alto Networks

<div>
 <strong>
  Our Mission
  <br/>
  <br/>
 </strong>
 At Palo Alto Networks&reg; everything starts and ends with our mission:
 <br/>
 <br/>
 Being the cybersecurity partner of choice, protecting our digital way of life.
 <br/>
 <br/>
 Our vision is a world where each day is safer and more secure than the one before. We are a company built on the foundation of challenging and disrupting the way things are done, and we&rsquo;re looking for innovators who are as committed to shaping the future of cybersecurity as we are.
 <br/>
 <br/>
 <strong>
  Who We Are
  <br/>
  <br/>
 </strong>
 This role is remote, but distance is no barrier to impact. Our hybrid teams collaborate across geographies to solve big problems, stay close to our customers, and grow together. You will be part of a culture that values trust, accountability, and shared success where your work truly matters.
 <br/>
 <br/>
 <strong>
  Job Description
  <br/>
  <br/>
 </strong>
 <strong>
  Your Career
  <br/>
  <br/>
 </strong>
 This role is client-facing and requires the Senior Consultant to help lead and produce deliverables based on reactive services client engagements. The Senior Consultant will work directly with multiple customers and key stakeholders (Admins, C-Suite, etc) to lead incident response incidents and guide clients through the engagement from start to finish.
 <br/>
 <br/>
 <strong>
  Your Impact
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Weekend Work Shift is Friday-Monday (10 hr work day/ 40 hr work week)
  </li>
  <li>
   Perform reactive incident response functions including but not limited to - host-based analysis functions through investigating Windows, Linux, and Mac OS X systems to identify Indicators of Compromise (IOCs)
  </li>
  <li>
   Examine firewall, web, database, and other log sources to identify evidence and artifacts of malicious and compromised activity
  </li>
  <li>
   Investigate data breaches leveraging forensics tools including Encase, FTK, X-Ways, SIFT, Splunk, and custom Unit 42 investigation tools to determine source of compromises and malicious activity that occurred in client environments
  </li>
  <li>
   Lead incident response engagements to guide clients through forensic investigations, contain security incidents, and provide guidance on longer term remediation recommendations
  </li>
  <li>
   Mentorship of Incident Response Consultants in incident response and forensics best practices
  </li>
  <li>
   Ability to perform light travel requirements as needed to meet business demands (on average 30%)
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Qualifications
  <br/>
  <br/>
 </strong>
 <strong>
  Your Experience
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   4+ years of incident response or digital forensics experience with a passion for cyber security
  </li>
  <li>
   Proficient with host-based forensics and data breach response
  </li>
  <li>
   Experienced with EnCase, FTK, X-Ways, SIFT, Splunk, Volatility, WireShark, TCPDump, and open source forensic tools
  </li>
  <li>
   Identified ability to grow into a valuable contributor to the practice and, specifically
  </li>
  <ul>
   <li>
    have an external presence via public speaking, conferences, and/or publications
   </li>
   <li>
    have credibility, executive presence, and gravitas
   </li>
   <li>
    be able to have a meaningful and rapid delivery contribution
   </li>
   <li>
    have the potential and capacity to understand all aspects of the business and an excellent understanding of PANW products
   </li>
   <li>
    be collaborative and able to build relationships internally, externally, and across all PANW functions, including the sales team
   </li>
  </ul>
  <li>
   Incident Response Consulting preferred
  </li>
  <li>
   Bachelor&rsquo;s Degree in Information Security, Computer Science, Digital Forensics, Cyber Security or related field or equivalent military experience required
   <br/>
  </li>
 </ul>
 <strong>
  Additional Information
  <br/>
  <br/>
 </strong>
 <strong>
  The Team
  <br/>
  <br/>
 </strong>
 Unit 42 Consulting is Palo Alto Network's security advisory team. Our vision is to create a more secure digital world by providing the highest quality incident response, risk management, and digital forensic services to clients of all sizes. Our team is composed of recognized experts and incident responders with deep technical expertise and experience in investigations, data breach response, digital forensics, and information security. With a highly successful track record of delivering mission-critical cybersecurity solutions, we are experienced in working quickly to provide an effective incident response, attack readiness, and remediation plans with a focus on providing long-term support to improve our clients&rsquo; security posture.
 <br/>
 <br/>
 <strong>
  Compensation Disclosure
  <br/>
  <br/>
 </strong>
 The compensation offered for this position will depend on qualifications, experience, and work location. For candidates who receive an offer at the posted level, the starting base salary (for non-sales roles) or base salary + commission target (for sales/commissioned roles) is expected to be between $128,000 - $176,000/YR. The offered compensation may also include restricted stock units and a bonus. A description of our employee benefits may be found here.
 <br/>
 <br/>
 <strong>
  Our Commitment
  <br/>
  <br/>
 </strong>
 We&rsquo;re problem solvers that take risks and challenge cybersecurity&rsquo;s status quo. It&rsquo;s simple: we can&rsquo;t accomplish our mission without diverse teams innovating, together.
 <br/>
 <br/>
 We are committed to providing reasonable accommodations for all qualified individuals with a disability. If you require assistance or accommodation due to a disability or special need, please contact us at accommodations@paloaltonetworks.com.
 <br/>
 <br/>
 Palo Alto Networks is an equal opportunity employer. We celebrate diversity in our workplace, and all qualified applicants will receive consideration for employment without regard to age, ancestry, color, family or medical care leave, gender identity or expression, genetic information, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, or other legally protected characteristics.
 <br/>
 <br/>
 All your information will be kept confidential according to EEO guidelines.
</div>


Senior Consultant, DFIR, Reactive Services (Unit 42) - Remote Weekend Shift

Htech Solution Pvt. Ltd.

<p><b>Certifications Required:</b> CEH, CompTIA Security+, SOC Handling, SIEM Implementation</p><p>&middot; Vendor-specific certifications: <b>ELK, QRadar, Wazuh</b> (advantage)</p><p>&middot; <b>Fortinet NSE, Cisco CyberOps, </b>(plus)</p><p>At least four years Bachelors in IT / Computer Science / Telecom/ Engineering</p><p>Experience: <b>3-4 years</b> of relevant professional experience in <b>SOC operations, cyber security, or incident response.</b></p><p><b>Responsibilities:</b></p><p>&middot; Monitor <b>real-time threats</b> and handle <b>security incidents</b> across Client IT systems using advanced SOC tools.</p><p>&middot; Deploy, configure, and manage <b>SIEM solutions</b> (Wazuh, Splunk, ELK, QRadar, etc.) for <b>log collection, analysis, intrusion detection, and anomaly reporting</b>.</p><p>&middot; Perform <b>malware analysis, digital forensics, and evidence preservation</b> to support <b>cybercrime investigations</b>.</p><p>&middot; Implement and integrate <b>threat intelligence feeds</b> tailored for <b>law enforcement use cases</b>.</p><p>&middot; Utilize frameworks such as <b>MITRE ATT&amp;CK and NIST</b> for <b>incident detection, classification, and response</b>.</p><p>&middot; Conduct <b>forensic investigations</b> with tools such as <b>Volatility, Autopsy, Ghidra, and IDA Pro</b>.</p><p>&middot; Carry out <b>vulnerability assessments, penetration testing, and remediation planning</b>.</p><p>&middot; Monitor and tune <b>firewalls, IDS/IPS, and VPN security</b> systems.</p><p>&middot; Familiarity with security tools and devices.</p><p>&middot; Support <b>law enforcement digital platforms</b> (CCTV, bodycams, and surveillance systems) by securing <b>data pipelines</b> and ensuring <b>data integrity</b>.</p><p>&middot; Conduct <b>awareness sessions</b> for Client officers on phishing, ransomware, and <b>cyber hygiene best practices</b>.</p><p>&middot; Collaborate with Client units for <b>proactive threat hunting and incident response</b>.</p><p>&middot; Manage the full <b>incident response lifecycle</b>: detection, triage, containment, eradication, recovery, and reporting.</p><p>&middot; Prepare <b>incident reports, forensic documentation, and compliance reviews</b> for audits and investigations.</p><p>&middot; Provide <b>IT assistance during emergency response operations</b>.</p><p>&middot; Perform any other tasks assigned by <b>Client</b>.</p><p>Job Type: Full-time</p><p>Work Location: In person</p>

SOC Engineer / Cyber Security Engineer

Accenture

<div><div><h2 class="jobSectionHeader"><b>About Accenture</b></h2><div>
Accenture is a leading global professional services company that helps the world&rsquo;s leading businesses, governments and other organizations build their digital core, optimize their operations, accelerate revenue growth and enhance citizen services&mdash;creating tangible value at speed and scale. We are a talent and innovation-led company serving clients in more than 120 countries.</div><h2 class="jobSectionHeader"><b>
Join Our Security Team</b></h2><div>
At Accenture Security, we help organizations build resilience and stay ahead of cyber threats. Our team combines deep technical expertise with strategic insight to deliver cutting-edge security solutions. If you&rsquo;re passionate about protecting businesses and driving innovation in cybersecurity, this is your opportunity to make an impact.</div><div><h2 class="jobSectionHeader"><b>
The Work</b></h2><ul><li>
Design and implement <b>security solutions</b> that enhance platform security and ensure robust protection.</li><li>
Govern the use of enterprise security tools and architecture frameworks to maintain compliance.</li><li>
Build and maintain <b>digital identity</b> and <b>cloud security</b> solutions for critical assets.</li><li>
Establish and optimize <b>Security Operations Center (SOC)</b> capabilities for threat detection and incident response.</li><li>
Own and align security strategy with enterprise policies and risk frameworks.</li></ul><h2 class="jobSectionHeader"><b>
Responsibilities</b></h2><ul><li>
Configure, manage, and optimize <b>SIEM platforms</b> (Splunk or equivalent) for real-time monitoring and threat detection.</li><li>
Develop and maintain <b>incident response playbooks</b> and escalation procedures.</li><li>
Implement <b>data protection measures</b> and ensure compliance with regulatory standards.</li><li>
Collaborate with cross-functional teams to integrate security controls into cloud and on-prem environments.</li><li>
Conduct risk assessments and recommend mitigation strategies.</li></ul></div></div></div><p></p>
<br>
<div><div><h2 class="jobSectionHeader"><b>What You Need</b></h2><ul><li><b>
Advanced proficiency</b> in Platform Security.</li><li>
Minimum <b>4 years of experience</b> in security engineering or related roles.</li><li><b>
Bachelor&rsquo;s degree</b> in Computer Science, Cybersecurity, or related field.</li><li>
Strong knowledge of SIEM tools, SOC operations, and enterprise security architecture.</li></ul><p></p><h2 class="jobSectionHeader"><b>
Bonus Points</b></h2><ul><li>
Intermediate proficiency in <b>Cybersecurity</b> and <b>Cloud Security</b>.</li><li>
Advanced proficiency in <b>Risk Management</b>.</li><li>
Expert proficiency in <b>Incident Response</b>.</li><li>
Master proficiency in <b>Data Protection</b>.</li></ul></div></div><p></p>

SIEM Engineer

<div><h2 class="jobSectionHeader"><b>About Accenture</b></h2><div><div><div><div><div><div><div><div><div><p>
Accenture is a leading global professional services company that helps the world&rsquo;s leading businesses, governments and other organizations build their digital core, optimize their operations, accelerate revenue growth and enhance citizen services&mdash;creating tangible value at speed and scale. We are a talent and innovation-led company serving clients in more than 120 countries.</p><p><b>
Join Our Security Team</b></p><p>
Join us in shaping the future of security solutions! You will have the opportunity to be a subject matter expert, collaborating with various teams to make impactful decisions. You will engage with multiple teams and contribute to key decisions while providing innovative solutions to challenges that arise. Your expertise in <b>Security Incident Response</b> will be invaluable as we work together to create a safer digital environment. We are excited to see how your contributions will help us thrive!</p><h2 class="jobSectionHeader"><b>
Key Responsibilities</b></h2><ul><li><p>
Design and implement security solutions that enhance organizational security posture.</p></li><li><p>
Govern the use of enterprise security tools and frameworks to ensure compliance and effectiveness.</p></li><li><p>
Build and maintain Security Operations Centers (SOC) to proactively detect and respond to cyber threats.</p></li><li><p>
Collaborate with cross-functional teams to align security strategies with business objectives.</p></li></ul></div></div></div></div></div></div></div></div></div></div><p></p>
<br>
<div><h2 class="jobSectionHeader"><b>Requirements</b></h2><ul><li><p><b>
Advanced proficiency</b> in Security Incident Response.</p></li><li><p>
Minimum <b>4 years of experience</b> in relevant security-related roles.</p></li><li><p><b>
Bachelor&rsquo;s Degree</b> in a relevant field of study.</p></li></ul><h2 class="jobSectionHeader"><b>
Bonus Points If You Have:</b></h2><ul><li><p>
Intermediate proficiency in Cybersecurity Frameworks.</p></li><li><p>
Advanced proficiency in Risk Management.</p></li><li><p>
Expert proficiency in Incident Management.</p></li><li><p>
Intermediate proficiency in Threat Intelligence.</p></li><li><p>
Master proficiency in Vulnerability Assessment.</p></li></ul></div>

SOC L2 Analyst – Security Transformation

<div></div><div><div><div><div><ul><div>3 - 5 Years</div>
<div></div><div>1 Opening</div>
 <div>Bangalore, Chennai, Hyderabad, Kochi, Trivandrum</div></ul></div><p></p><div><br>
<div><div>
</div></div></div></div><div></div><div><h3 class="jobSectionHeader"><b>Role description</b></h3>
<div><p>Key Responsibilities</p>
<ul><li>Implement SecOps Modules: Configure Security Incident Response (SIR), Vulnerability Response (VR), and Threat Intelligence workflows.</li></ul>
<ul><li>ITOM Configuration: Deploy and maintain Discovery, Service Mapping, and Event Management for accurate CMDB and operational health.</li></ul>
<ul><li>Integration: Connect ServiceNow with SIEM tools, vulnerability scanners (e.g., Qualys, Tenable), and monitoring systems.</li></ul>
<ul><li>Automation: Use Orchestration and Flow Designer to automate remediation and operational tasks.</li></ul>
<ul><li>CMDB Management: Ensure accurate configuration item (CI) data for both security and operations.</li></ul>
<ul><li>Incident &amp; Change Alignment: Link security incidents to ITSM processes for coordinated response.</li></ul>
<ul><li>Monitoring &amp; s: Configure Event Management to correlate s and trigger automated workflows.</li></ul>
<ul><li>Compliance &amp; Governance: Support regulatory compliance through integrated security and operational controls.</li></ul>
<ul><li>Collaboration: Work with cybersecurity, IT operations, and infrastructure teams to deliver end-to-end solutions.</li></ul>
<p></p>
<p>Required Skills</p>
<ul><li>Strong hands-on experience with ServiceNow SecOps (SIR, VR) and ITOM (Discovery, Service Mapping, Event Management).</li></ul>
<ul><li>Proficiency in ServiceNow scripting (JavaScript, Glide).</li></ul>
<ul><li>Knowledge of ITIL processes and security frameworks.</li></ul>
<ul><li>Experience with API integrations and MID Server configuration.</li></ul>
<ul><li>Familiarity with cloud environments (AWS, Azure) and monitoring tools.</li></ul>
<ul><li>ServiceNow certifications (SecOps and ITOM Implementation Specialist preferred).</li></ul></div>
<h3 class="jobSectionHeader"><b>Skills</b></h3>
<div><p>Servicenow,Itom,SecOps,Itil</p></div></div></div></div><p></p>
<br><div><h3 class="jobSectionHeader"><b>About UST</b></h3>
<div>UST is a global digital transformation solutions provider. For more than 20 years, UST has worked side by side with the world&rsquo;s best companies to make a real impact through transformation. Powered by technology, inspired by people and led by purpose, UST partners with their clients from design to operation. With deep domain expertise and a future-proof philosophy, UST embeds innovation and agility into their clients&rsquo; organizations. With over 30,000 employees in 30 countries, UST builds for boundless impact&mdash;touching billions of lives in the process.</div></div>

Developer III - Software Engineering (ServiceNow+SecOps)

Search 6679+ Incident response specialist jobs near you this January. New roles added regularly across leading industries. Apply today.