Engineer II, Cybersecurity Incident Response

Back

Engineer II, Cybersecurity Incident Response

Bangalore, Karnataka, India

Bangalore, India

Cybersecurity

129560

Hybrid

Job Description

Cyber Risk and Incident Response

Engineer II, Cybersecurity Incident Response

Exp 3-5 yrs

Bengaluru, India

Position Summary

We are looking for a motivated Cyber Risk & Incident Response engineer to join the Enterprise IT Infrastructure Security team in Bengaluru. The position supports the mitigation of cyber risks and response to incidents impacting Schneider Electric digital assets and population.

The role is intentionally generalist: it combines cyber risk analysis, incident response, threat awareness, IT/infrastructure understanding, and practical automation skills.

The successful candidate will help identify risk scenario impacting Schneider Electric, support mitigation strategies, assist in incident response investigations, and contribute to automate processes and implementing AI tooling to scale up services within the team.

Role Mission

Help identify, assess, and reduce cyber risks affecting critical assets within Schneider Electric.

Support investigations and incident response activities related to executive account, identity, device, phishing, credential theft, and social engineering scenarios.

Contribute to the definition of practical mitigation strategies, controls, playbooks, and follow-up actions.

Use scripting, data analysis, and AI-assisted automation to improve detection, triage, reporting, and risk monitoring workflows.

Key Responsibilities

Cyber Risk Management

Support the assessment and monitoring of cyber risks affecting critical digital assets and population.

Identify recurring risk patterns, exposure scenarios.

Assist in defining and tracking mitigation actions to reduce likelihood and impact on critical assets and population.

Prepare structured risk summaries, observations, and recommendations for internal stakeholders.

Incident Response Support

Support the incident response lifecycle, including triage, analysis, containment support, recovery coordination, and post-incident actions.

Assist with the collection and analysis of evidence, indicators of compromise, suspicious sign-in activity, phishing artefacts, endpoint alerts, and relevant security telemetry.

Coordinate with SOC, Cyber Defense, Identity, Infrastructure, Forensics, Threat Intelligence, and regional security teams as needed.

Document investigation steps, findings, decisions, and lessons learned in a clear and structured manner.

Security Analysis & Threat Awareness

Analyze common attack vectors.

Monitor relevant threat intelligence and translate it into practical risk observations and recommended actions.

Support proactive reviews, hunting hypotheses, and control validation activities.

Automation, Coding & AI Enablement

Develop and maintain simple scripts, queries, or workflows to automate repetitive security and reporting tasks.

Contribute to the adoption of AI-assisted security operations capabilities, including Copilot-based summaries, workflow automation, and investigation support use cases.

Propose pragmatic improvements to reduce manual effort and increase consistency in risk identification, triage, and reporting.

Collaboration & Communication

Work effectively with global teams, regional CISOs, Digital Risk Leaders, SOC, Identity, Infrastructure, and other stakeholders.

Communicate technical observations in clear English to both technical and non-technical audiences.

Maintain discretion and professionalism when working on sensitive cases involving company leaders.

Contribute to playbooks, knowledge articles, lessons learned, and continuous improvement activities.

Desired Technical Skills

Cybersecurity Risk Management (Intermediate)

Master cyber risk scenarios, impact, likelihood, controls, and mitigation plans.

Incident Response (Beginner)

Understand triage, analysis, containment, recovery, evidence gathering, and post-incident action tracking.

Security Monitoring / SIEM (Beginner)

Ability to use security monitoring tools and understand alerts, events, queries, and investigation timelines.

Identity & Access Security (Beginner)

Understand account compromise, MFA, privileged access, suspicious sign-ins, and executive identity protection scenarios.

Network Security (Beginner)

Understand firewalls, proxies, IDS/IPS, WAF, network protocols, and common network security concepts.

Windows Administration (Beginner)

Understand Windows environments, users, services, logs, endpoints, and basic administration concepts.

Linux Administration (Beginner)

Understand basic Linux operating system concepts and command-line usage.

Cloud Security (Azure / AWS) (Beginner)

Understand basic cloud concepts and common security controls in Azure and AWS.

Vulnerability Management (Intermediate)

Understand vulnerability impact, prioritization, remediation tracking, and risk-based decision making.

Threat Intelligence (Beginner)

Understand how to gather and interpret threat information relevant to executive-targeted risks.

Digital Forensics (Beginner)

Understand basic evidence handling, artifact review, and forensic investigation concepts.

Coding & Automation (Beginner)

Use Python, PowerShell, Bash, KQL, Power Automate, APIs, or similar tools to automate data processing, reporting, and investigation tasks.

AI-Assisted Security Operations (Beginner)

Understand how AI and copilots can support summaries, enrichment, workflow automation, and repetitive security tasks.

Experience & Education

Required

3-5 years of professional experience in Cybersecurity, risk management, security operations, or incident response.

Technical background in computer science, information technology, cybersecurity, engineering, or related discipline.

Good understanding of enterprise IT environments and ability to connect technical facts with business risk.

Working proficiency in English, both written and spoken.

Preferred

Exposure to security risk management, incident response, vulnerability management, ident