Senior Incident Response Analyst

ZS is a place where passion changes lives. As a management consulting and technology firm focused on improving life and how we live it, we transform ideas into impact by bringing together data, science, technology and human ingenuity to deliver better outcomes for all. Here you’ll work side-by-side with a powerful collective of thinkers and experts shaping life-changing solutions for patients, caregivers and consumers, worldwide. ZSers drive impact by bringing a client-first mentality to each and every engagement. We partner collaboratively with our clients to develop custom solutions and technology products that create value and deliver company results across critical areas of their business. Bring your curiosity for learning, bold ideas, courage and passion to drive life-changing impact to ZS.

What you'll do: Senior Incident Response Analyst in the Enterprise will…

• Lead end-to-end investigations for complex incidents: validate alert context, determine scope, assess impact, and build an audit-ready timeline and evidence trail.
• Apply a forensic mindset to every investigation: preserve volatile and non-volatile evidence early, maintain chain of custody, and ensure findings are reproducible and can withstand legal, regulatory, or client scrutiny.
• Act as an escalation point for high-priority security events and ambiguous cases; guide triage-to-investigation handoffs and ensure defensible conclusions.
• Perform endpoint, memory, and cloud forensic triage (e.g., disk and memory captures, system artifacts, cloud audit logs) to reconstruct attacker activity and root cause; support third-party forensic partners on high-severity cases and validate their findings.
• Coordinate containment, eradication, and recovery actions with system owners and partner teams; verify remediation completion and document closure rationale.
• Partner with the Senior Incident Response Lead on incident command execution, including stakeholder communications cadence, task tracking, and post-incident action closure.
• Leverage the Incident Response Specialist for deep technical analysis and quality reviews; incorporate feedback into investigation standards and templates.
• Maintain and improve incident response playbooks, checklists, and communication templates based on lessons learned and recurring incident patterns.
• Contribute to readiness exercises (tabletops/purple-team activities) and ensure outcomes translate into concrete corrective actions.
• Create incident metrics and reporting inputs (e.g., response timeliness, containment effectiveness, recurring root causes) to support operational governance.
• Use automation as a mindset: identify repeatable steps in investigations suitable for automation or AI assistance (summaries, enrichment notes, evidence packaging) and validate outputs against source artifacts before operational use.

What you’ll bring:

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience).
• 3–5 years of experience in security operations with hands-on incident response experience, including ownership of complex investigations.
• Strong understanding of attacker techniques, threat vectors, and incident management practices; ability to distinguish between benign/commodity activity and advanced threats.
• Ability to analyze data from multiple sources (endpoint, cloud, network, and application logs) and produce defensible conclusions.
• Working knowledge of digital forensics fundamentals, including evidence acquisition, chain of custody, Windows/Linux artifacts (e.g., event logs, registry, prefetch, browser history), and timeline analysis.
• Investigative curiosity and strong attention to detail; ability to form and test hypotheses, separate facts from assumptions, and support every conclusion with evidence.
• Strong stakeholder communication skills, including clear written updates and the ability to present findings in business-friendly language.
• Ability to work effectively under pressure and coordinate across multiple teams to drive action closure.
• Experience with Microsoft Sentinel and cloud security investigations across AWS, Azure, and GCP.
• Familiarity with EDR/NGAV, network security tooling, DLP/encryption controls, and vulnerability assessment concepts.
• Hands-on experience with forensic and live-response tools such as KAPE, Velociraptor, Volatility, Autopsy/FTK, or EDR-based remote collection.
• Exposure to cloud and SaaS forensics (e.g., AWS CloudTrail, Azure/Entra ID, Microsoft 365 audit logs) and basic malware or malicious script analysis.
• Experience using scripting, automation, or AI-enhanced analytics to reduce manual investigation effort while maintaining quality.
• Coursework, specialization, or formal training in Digital Forensics or Cyber Forensics is an advantage.
• Preferred certifications (any two are a plus): Security+, CySA+, GCIH, GCFA, Microsoft Security certifications, AWS security certifications.
• Forensics-focused certifications (e.g., GCFE, GCFA, CHFI, or vendor certifications such as Magnet AXIOM) are a plus.
• CISSP/CISM is a plus.
• Fluency in English
• Client-first mentality
• Intense work ethic
• Collaborative spirit and problem-solving approach

How you’ll grow:

• Cross-functional skills development & custom learning pathways
• Milestone training programs aligned to career progression opportunities
• Internal mobility paths that empower growth via s-curves, individual contribution and role expansions

Perks & Benefits:

At ZS, your growth matters. We offer a comprehensive total rewards package that supports your health and well‑being, financial future, time away, and professional development. With robust skills‑building programs, multiple career progression paths, internal mobility, and a deeply collaborative culture, you’ll have the opportunity to do meaningful work, expand your capabilities, and thrive as part of a global community. For details on total rewards in India, visit ZS India office locations | Where we work | ZS.                

Hybrid working model:

We are committed to giving our employees a flexible and connected way of working.  A flexible and connected ZS allows us to combine work from home and on-site presence at clients/ZS offices for the majority of our week. The magic of ZS culture and innovation thrives in both planned and spontaneous face-to-face connections.

Travel:

Travel is a requirement at ZS for client facing ZSers; business needs of your project and client are the priority. While some projects may be local, all client-facing ZSers should be prepared to travel as needed.  Travel provides opportunities to strengthen client relationships, gain diverse experiences, and enhance professional growth by working in different environments and cultures.

Considering applying?

At ZS, we honor the visible and invisible elements of our identities, personal experiences, and belief systems—the ones that comprise us as individuals, shape who we are, and make us unique. We believe your personal interests, identities, and desire to learn are integral to your success here. We are committed to building a team that reflects a broad variety of backgrounds, perspectives, and experiences. Learn more about our inclusion and belonging efforts and the networks ZS supports to assist our ZSers in cultivating community spaces and obtaining the resources they need to thrive.

If you’re eager to grow, contribute, and bring your unique self to our work, we encourage you to apply.

ZS is an equal opportunity employer and is committed to providing equal employment and advancement opportunities without regard to any class protected by applicable law.

To complete your application:
Candidates must possess or be able to obtain work authorization for their intended country of employment. An on-line application, including a full set of transcripts (official or unofficial), is required to be considered.

NO AGENCY CALLS, PLEASE.

Find Out More At:
www.zs.com

What you'll do: Senior Incident Response Analyst in the Enterprise will…

• Lead end-to-end investigations for complex incidents: validate alert context, determine scope, assess impact, and build an audit-ready timeline and evidence trail.
• Apply a forensic mindset to every investigation: preserve volatile and non-volatile evidence early, maintain chain of custody, and ensure findings are reproducible and can withstand legal, regulatory, or client scrutiny.
• Act as an escalation point for high-priority security events and ambiguous cases; guide triage-to-investigation handoffs and ensure defensible conclusions.
• Perform endpoint, memory, and cloud forensic triage (e.g., disk and memory captures, system artifacts, cloud audit logs) to reconstruct attacker activity and root cause; support third-party forensic partners on high-severity cases and validate their findings.
• Coordinate containment, eradication, and recovery actions with system owners and partner teams; verify remediation completion and document closure rationale.
• Partner with the Senior Incident Response Lead on incident command execution, including stakeholder communications cadence, task tracking, and post-incident action closure.
• Leverage the Incident Response Specialist for deep technical analysis and quality reviews; incorporate feedback into investigation standards and templates.
• Maintain and improve incident response playbooks, checklists, and communication templates based on lessons learned and recurring incident patterns.
• Contribute to readiness exercises (tabletops/purple-team activities) and ensure outcomes translate into concrete corrective actions.
• Create incident metrics and reporting inputs (e.g., response timeliness, containment effectiveness, recurring root causes) to support operational governance.
• Use automation as a mindset: identify repeatable steps in investigations suitable for automation or AI assistance (summaries, enrichment notes, evidence packaging) and validate outputs against source artifacts before operational use.

What you’ll bring:

• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience).
• 3–5 years of experience in security operations with hands-on incident response experience, including ownership of complex investigations.
• Strong understanding of attacker techniques, threat vectors, and incident management practices; ability to distinguish between benign/commodity activity and advanced threats.
• Ability to analyze data from multiple sources (endpoint, cloud, network, and application logs) and produce defensible conclusions.
• Working knowledge of digital forensics fundamentals, including evidence acquisition, chain of custody, Windows/Linux artifacts (e.g., event logs, registry, prefetch, browser history), and timeline analysis.
• Investigative curiosity and strong attention to detail; ability to form and test hypotheses, separate facts from assumptions, and support every conclusion with evidence.
• Strong stakeholder communication skills, including clear written updates and the ability to present findings in business-friendly language.
• Ability to work effectively under pressure and coordinate across multiple teams to drive action closure.
• Experience with Microsoft Sentinel and cloud security investigations across AWS, Azure, and GCP.
• Familiarity with EDR/NGAV, network security tooling, DLP/encryption controls, and vulnerability assessment concepts.
• Hands-on experience with forensic and live-response tools such as KAPE, Velociraptor, Volatility, Autopsy/FTK, or EDR-based remote collection.
• Exposure to cloud and SaaS forensics (e.g., AWS CloudTrail, Azure/Entra ID, Microsoft 365 audit logs) and basic malware or malicious script analysis.
• Experience using scripting, automation, or AI-enhanced analytics to reduce manual investigation effort while maintaining quality.
• Coursework, specialization, or formal training in Digital Forensics or Cyber Forensics is an advantage.
• Preferred certifications (any two are a plus): Security+, CySA+, GCIH, GCFA, Microsoft Security certifications, AWS security certifications.
• Forensics-focused certifications (e.g., GCFE, GCFA, CHFI, or vendor certifications such as Magnet AXIOM) are a plus.
• CISSP/CISM is a plus.
• Fluency in English
• Client-first mentality
• Intense work ethic
• Collaborative spirit and problem-solving approach

How you’ll grow:

• Cross-functional skills development & custom learning pathways
• Milestone training programs aligned to career progression opportunities
• Internal mobility paths that empower growth via s-curves, individual contribution and role expansions

Perks & Benefits:

At ZS, your growth matters. We offer a comprehensive total rewards package that supports your health and well‑being, financial future, time away, and professional development. With robust skills‑building programs, multiple career progression paths, internal mobility, and a deeply collaborative culture, you’ll have the opportunity to do meaningful work, expand your capabilities, and thrive as part of a global community. For details on total rewards in India, visit ZS India office locations | Where we work | ZS.                

Hybrid working model:

We are committed to giving our employees a flexible and connected way of working.  A flexible and connected ZS allows us to combine work from home and on-site presence at clients/ZS offices for the majority of our week. The magic of ZS culture and innovation thrives in both planned and spontaneous face-to-face connections.

Travel:

Travel is a requirement at ZS for client facing ZSers; business needs of your project and client are the priority. While some projects may be local, all client-facing ZSers should be prepared to travel as needed.  Travel provides opportunities to strengthen client relationships, gain diverse experiences, and enhance professional growth by working in different environments and cultures.

Considering applying?

At ZS, we honor the visible and invisible elements of our identities, personal experiences, and belief systems—the ones that comprise us as individuals, shape who we are, and make us unique. We believe your personal interests, identities, and desire to learn are integral to your success here. We are committed to building a team that reflects a broad variety of backgrounds, perspectives, and experiences. Learn more about our inclusion and belonging efforts and the networks ZS supports to assist our ZSers in cultivating community spaces and obtaining the resources they need to thrive.

If you’re eager to grow, contribute, and bring your unique self to our work, we encourage you to apply.

ZS is an equal opportunity employer and is committed to providing equal employment and advancement opportunities without regard to any class protected by applicable law.

To complete your application:
Candidates must possess or be able to obtain work authorization for their intended country of employment. An on-line application, including a full set of transcripts (official or unofficial), is required to be considered.

NO AGENCY CALLS, PLEASE.

Find Out More At:
www.zs.com