Deloitte is hiring for the Analyst – Incident Response & Handling position in Delhi, India. This opportunity is suitable for candidates with 0–2 years of experience, including freshers with relevant cybersecurity projects, internships, SOC exposure or practical lab experience.
Selected candidates will work with Deloitte’s Cyber team, supporting cybersecurity investigations, incident response, threat hunting, malware triage and digital forensics engagements. The role offers exposure to security technologies, investigation tools and enterprise incident response processes while working alongside experienced cybersecurity professionals.
Candidates with a Bachelor’s or Master’s degree and foundational knowledge of Windows, Linux, networking, SIEM, EDR and security investigation concepts can review the eligibility criteria and apply through the official Deloitte careers portal.
Job Overview
| Details | Information |
|---|---|
| Company | Deloitte |
| Job Role | Analyst – Incident Response & Handling |
| Job Requisition ID | 114743 |
| Qualification | Bachelor’s / Master’s Degree |
| Experience | 0–2 Years |
| Freshers | Eligible with relevant projects, internships or SOC exposure |
| Location | Delhi, India |
| Entity | Deloitte Touche Tohmatsu India LLP |
| Job Category | Cybersecurity |
| Salary | Not disclosed |
| Employment Type | Not specified |
About Deloitte
Deloitte is a global professional services organization providing consulting, technology, risk advisory and business services.
Its Cyber team helps organizations prevent cyberattacks, respond to security incidents and protect critical digital assets. The team works across cybersecurity strategy, threat detection, incident response and digital risk management to help businesses become more secure, vigilant and resilient.
Job Description
As an Analyst in Incident Response & Handling, candidates will support cybersecurity investigations and incident response engagements under the guidance of experienced team members.
The role involves reviewing security events, collecting and analyzing digital evidence, assisting with threat hunting and malware triage, and documenting investigation findings.
Candidates will work with evidence sources such as endpoint detection and response telemetry, SIEM alerts, Windows event logs, identity logs, cloud audit logs, network telemetry and mailbox artefacts.
The position also provides exposure to incident response processes, forensic investigation utilities, security monitoring platforms and enterprise cybersecurity operations.
Roles and Responsibilities
1. Incident Response and Investigation
- Support initial incident triage, event validation and evidence collection.
- Assist with incident scoping and containment tracking.
- Support recovery activities and post-incident documentation.
- Investigate phishing, credential compromise, suspicious authentication and malware execution.
- Assist in identifying persistence, privilege abuse, lateral movement and ransomware-related activity.
- Maintain investigation timelines, case notes and evidence trackers.
- Escalate findings to senior team members for further analysis.
2. Threat Hunting and Security Monitoring
- Review security events using SIEM and EDR platforms.
- Analyze Windows event logs, Sysmon data and identity logs.
- Review cloud audit logs, network telemetry and mailbox evidence.
- Run approved SIEM, EDR and threat-hunting queries.
- Document query results and assist with query refinement.
- Support investigations using relevant threat intelligence and security evidence.
3. Malware Analysis and Digital Forensics
- Assist with malware triage using file metadata, hashes and strings.
- Review sandbox results, process behaviour and persistence indicators.
- Perform basic forensic triage of Windows and Linux systems.
- Review registry artefacts, prefetch files, scheduled tasks and services.
- Analyze PowerShell logs, browser artefacts and process execution evidence.
- Prepare evidence summaries and technical investigation notes.
4. Documentation and Reporting
- Maintain accurate case notes and investigation timelines.
- Prepare evidence summaries, indicator lists and draft technical findings.
- Document investigation decisions and action items.
- Maintain structured evidence trails and query records.
- Support root cause assessments and lessons-learned documentation.
- Follow evidence-handling, confidentiality and quality requirements.
5. Collaboration and Continuous Learning
- Work with SOC, engineering, identity, cloud and infrastructure teams.
- Support incident bridge calls and technical discussions.
- Maintain action trackers and capture important investigation decisions.
- Participate in incident response simulations and playbook reviews.
- Attend training, knowledge-sharing sessions and lab exercises.
- Collaborate with senior team members to improve investigation capabilities.
Eligibility Criteria
Candidates interested in the Deloitte Analyst – Incident Response & Handling role should meet the following requirements:
- Bachelor’s or Master’s degree.
- Overall experience of 0–2 years in cybersecurity.
- Freshers with relevant academic projects, internships, lab work or SOC exposure can apply.
- Foundational knowledge of Windows and Linux operating systems.
- Understanding of networking, Active Directory, DNS and authentication concepts.
- Basic knowledge of cybersecurity monitoring and incident response processes.
- Interest in digital forensics, malware analysis and threat hunting.
- Ability to document technical findings clearly and accurately.
- Strong analytical thinking, attention to detail and willingness to learn.
Practical exposure through internships, academic projects, cybersecurity labs, simulations or security monitoring activities is preferred.
Required Technical Skills
The job description highlights the following technical areas:
- Cybersecurity and Incident Response
- Threat Hunting
- SIEM and EDR
- Malware Analysis and Triage
- Digital Forensics
- Windows and Linux
- Active Directory
- DNS and Networking
- Windows Event Logs
- Sysmon
- PowerShell
- Registry Artefacts
- MITRE ATT&CK Framework
- Cyber Kill Chain
- Evidence Collection and Analysis
- Security Monitoring
Security Tools and Technologies
Candidates may work with or benefit from familiarity with the following tools:
| Category | Tools / Technologies |
|---|---|
| SIEM | QRadar, Microsoft Sentinel |
| EDR | CrowdStrike, Microsoft Defender, SentinelOne |
| Forensics | KAPE, Eric Zimmerman Tools, Velociraptor |
| Investigation Utilities | CyberChef, Sysinternals |
| Network Analysis | Wireshark |
| Scripting | Python, PowerShell, Bash |
| Query Languages | KQL, SPL, SQL |
| Security Frameworks | MITRE ATT&CK, Cyber Kill Chain |
The listing also mentions SOAR technologies, incident response playbooks, case-management workflows and ITSM tools as desirable areas of familiarity.
Preferred Certifications
The following certifications are listed as preferred:
- GCIH – GIAC Certified Incident Handler
- GCFA – GIAC Certified Forensic Analyst
- ECIH v2 – EC-Council Certified Incident Handler
- CHFI – Computer Hacking Forensic Investigator
- GCIA – GIAC Certified Intrusion Analyst
- SC-200 – Microsoft Security Operations Analyst
These certifications are preferred rather than stated as mandatory requirements.
Why Consider This Opportunity?
- Opportunity to work with Deloitte’s Cyber team.
- Exposure to real-world incident response and cybersecurity investigations.
- Practical experience with SIEM and EDR platforms.
- Exposure to threat hunting, malware triage and digital forensics.
- Opportunity to work with experienced cybersecurity professionals.
- Learning opportunities across Windows, Linux, cloud and network security.
- Exposure to investigation tools and industry security frameworks.
Job Location
- Location: Delhi, India.
- Entity: Deloitte Touche Tohmatsu India LLP.
- Job Requisition ID: 114743.
The supplied job listing identifies Delhi as the job location. Work mode and salary are not specified in the provided description.
How to Apply for Deloitte Incident Response & Handling Jobs
Interested and eligible candidates can apply through the official Deloitte South Asia careers portal.
Application Steps:
- Visit the official Deloitte job listing.
- Review the responsibilities and eligibility criteria.
- Prepare an updated resume highlighting cybersecurity projects, internships, SOC exposure and relevant technical skills.
- Click the Apply option.
- Complete the application form and submit your details.
Apply Online: Click here
Frequently Asked Questions
1. Is Deloitte hiring freshers for Incident Response & Handling?
Yes. The job description accepts candidates with 0–2 years of cybersecurity experience. Freshers with relevant projects, internships, lab work or SOC exposure can apply.
2. What is the qualification required?
Candidates with a Bachelor’s or Master’s degree are eligible to apply.
3. What is the job location?
The position is based in Delhi, India.
4. What is the required experience?
The job description specifies 0–2 years of overall cybersecurity experience.
5. What are the key skills required?
Key areas include Cybersecurity, Incident Response, Threat Hunting, SIEM/EDR, Malware Analysis, Digital Forensics, Windows, Linux and Networking.
6. Is prior SOC experience mandatory?
The description prefers practical exposure through security monitoring, internships, projects, labs or SOC work. It does not state that professional SOC experience is mandatory.
7. Which certifications are preferred?
Certifications such as GCIH, GCFA, ECIH v2, CHFI, GCIA and SC-200 are preferred.
8. What is the salary offered?
The salary is not disclosed in the supplied job description. Candidates should confirm compensation details during the recruitment process.
Disclaimer
This article is for informational purposes only and is based on the Deloitte job description supplied. It is not an official communication from Deloitte. Verify the latest eligibility criteria, job availability and employment details through the official careers website before applying. No selection guarantee or payment is required.
