Cyber Analyst - Incident Response & Handling

About the role

Apply on Deloitte's official South Asia careers page. Deloitte is hiring a Cyber Analyst - Incident Response & Handling in Delhi. The posting asks for overall experience of 0 to 2 years in cybersecurity, including relevant internships, academic projects, lab work, SOC exposure, incident response, digital forensics, threat hunting, malware analysis or security monitoring. The analyst supports incident investigation, evidence collection, SIEM/EDR queries, malware triage and basic forensic triage under guidance. Salary is not stated. The posting was checked live on 15 Nov 2026 on Deloitte's South Asia careers site and was listed as open for applications.

Responsibilities

• Support incident bridge calls and technical discussions by maintaining action trackers, capturing key decisions, and preparing concise investigation updates
• Collaborate with SOC, engineering, identity, cloud and infrastructure teams to obtain evidence and support investigation activities
• Support incident response assessments, simulations, playbook reviews and after-action documentation
• Contribute supporting evidence and analysis for root cause assessment, lessons learned and resilience improvement recommendations
• Participate in training, knowledge-sharing, lab exercises and feedback sessions
• Follow evidence-handling, confidentiality, documentation and quality-review requirements
• Prepare clear investigation notes, evidence summaries, timelines, indicator lists and draft technical findings for review by senior team members
• Use investigation utilities such as CyberChef, Sysinternals, Wireshark, KAPE, Eric Zimmerman tools, Velociraptor or comparable tools as appropriate
• Run approved SIEM, EDR and threat-hunting queries and document results accurately; assist with query refinement under guidance
• Support malware triage using file metadata, hashes, strings, sandbox results, process behaviour, persistence indicators and identified network connections
• Perform basic forensic triage of Windows and Linux systems, including review of event logs, registry artefacts, prefetch, scheduled tasks, services, PowerShell logs, browser artefacts and process execution evidence under guidance

Requirements

• Overall experience of 0 to 2 years in cybersecurity, including relevant internships, academic projects, lab work, SOC exposure, incident response, digital forensics, threat hunting, malware analysis, or security monitoring
• Practical exposure to security monitoring or investigation through employment, internships, projects, labs, simulations, or academic work is preferred
• Foundational knowledge of Windows, Linux, Active Directory, DNS, networking, authentication, and common enterprise security concepts
• Familiarity with SIEM or EDR platforms such as QRadar, Microsoft Sentinel, CrowdStrike, Microsoft Defender, SentinelOne, or equivalent is desirable
• Basic understanding of the MITRE ATT&CK framework, cyber kill chain, common attacker techniques, and the incident response lifecycle
• Bachelor’s / Master’s degree, as listed on the posting

Required Skills