Cyber Incident Response Lead

Help AG, an e& enterprise company; Abu Dhabi; On-site; AED 279,000 - 446,400; Full time

Benefits offered by this job

Career progression

Learning and development

Flexible working

Open door policy

Job summary

Help AG is seeking an Incident Response Specialist to identify, analyze, contain, and respond to cybersecurity incidents across the enterprise. The role involves coordinating IR activities, conducting forensic investigations, and working with stakeholders to minimize business impact while enhancing cyber resilience.

You will monitor alerts, lead technical investigations, perform real-time incident handling, and prepare executive summaries and post-incident reports.

Qualifications

• Minimum 2–4 years in cybersecurity with 3+ years in incident response/SOC.
• Proven IR lifecycle experience: preparation to post-incident reviews.
• Hands-on with SIEM, EDR, logs, and threat hunting.

Responsibilities

• Monitor security alerts from SIEM/EDR/IDS-IPS and firewalls.
• Lead investigations and coordinate incident response across teams.
• Perform containment, eradication, and recovery during incidents.
• Forensic evidence collection and malware analysis with chain of custody.

Skills

Incident response

SOC operations

Digital forensics

Threat intelligence

ELK/SIEM analysis

EDR expertise

MITRE ATT&CK

Log analysis

Scripting (PowerShell/Python/Bash)

Reporting & communication

Education

Bachelor's degree in Computer Science or related field

Tools

Microsoft Defender for Endpoint

CrowdStrike Falcon

QRadar / Splunk / Sentinel

ArcSight

Job description

Help AG is seeking an Incident Response Specialist to identify, analyze, contain, and respond to cybersecurity incidents across the enterprise. The role involves coordinating IR activities, conducting forensic investigations, and working with stakeholders to minimize business impact while enhancing cyber resilience.

You will monitor alerts, lead technical investigations, perform real-time incident handling, and prepare executive summaries and post-incident reports.