Assistant Manager - Incident Response / Threat Hunting / SIEM

Job Summary

KPMG Assurance and Consulting Services LLP is looking for a seasoned Incident Responder with more than 6 years of practical experience across cyber security operations. The role focuses on detecting, investigating, containing, and remediating incidents, with strong capability in threat hunting and security incident response. Experience with SOX (Sarbanes-Oxley) compliance is also important. You will work closely with SOC, Security Engineering, Risk, Audit, and IT teams to reduce business disruption and improve the overall security posture.

Key Responsibilities

• Own the full incident response process, from initial detection and analysis through containment, eradication, and recovery.
• Handle investigations for malware, phishing, ransomware, insider activity, and advanced persistent threats.
• Carry out proactive threat hunting using SIEM, EDR, network data, and endpoint telemetry.
• Review alerts and logs from security platforms to spot indicators of compromise and adversary behavior.
• Build, refine, and maintain incident response playbooks, procedures, and operational workflows.
• Perform forensic analysis and determine root causes of security events.
• Help maintain SOX compliance for information security and access management controls.
• Support security audits and prepare evidence needed for SOX-related checks.
• Work with IT, infrastructure, application, and audit teams to close security gaps.
• Track threat intelligence sources and evaluate exposure to new and emerging threats.
• Prepare incident documentation, executive-level summaries, and post-incident reviews.
• Suggest security enhancements based on investigation outcomes and threat hunting findings.
• Guide junior analysts and support initiatives that improve SOC maturity.

Technical Requirements

• At least 6 years of experience in a SOC or incident response environment.
• Strong working knowledge of the incident response lifecycle.
• Hands-on experience in threat hunting, digital forensics, malware analysis, log analysis, and security monitoring.
• Practical experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, and ArcSight.
• Exposure to EDR/XDR solutions including Microsoft Defender, CrowdStrike Falcon, SentinelOne, and Carbon Black.
• Understanding of the MITRE ATT&CK framework and the Cyber Kill Chain model.
• Good knowledge of Windows, Linux, Active Directory, Azure AD, and cloud security principles.
• Experience with network security, packet analysis, IDS/IPS, and firewall technologies.

Additional Information

This role is based in Bengaluru, India.

Compensation is listed at INR 12,00,000 to 20,00,000 per year.