DFIR Analyst

Keka Technologies Private Limited; Abu Dhabi; On-site; AED 180,000 - 290,000; Full time

Job summary

Keka Technologies Private Limited in Abu Dhabi is seeking a DFIR Analyst to lead and participate in all phases of the incident response lifecycle. You will investigate digital forensics, collect evidence from endpoints, networks, and cloud environments, and work with IT, legal, and compliance teams.

The ideal candidate has 3–5 years in digital forensics and incident response, strong OS and cloud knowledge, experience with EnCase, FTK, X-Ways, Volatility, and scripting in Python or PowerShell.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, or a related field.
• Minimum of 3–5 years of experience in digital forensics and incident response.
• Strong understanding of operating systems (Windows, Linux, macOS), network protocols, and cloud platforms.
• Proficiency with forensic tools (EnCase, FTK, X-Ways, Volatility) and IR platforms.
• Experience with scripting languages (Python, PowerShell) for automation and analysis.
• Excellent analytical, problem-solving, and communication skills.

Responsibilities

• Lead and participate in all phases of the incident response lifecycle (preparation, detection/analysis, containment, eradication, recovery, post-incident).
• Conduct in-depth digital forensic investigations to identify root cause, scope, and impact.
• Collect, preserve, and analyze digital evidence from endpoints, networks, and cloud environments.
• Reconstruct events, identify attacker methodologies, and attribute threats.
• Develop containment/eradication strategies and post-incident reports.
• Collaborate with IT, legal/compliance and external partners during IR efforts.
• Contribute to development and improvement of DFIR processes, playbooks, and tools.
• Stay current with threat intelligence, attack techniques, and forensic methodologies.
• Provide training and mentorship to junior team members.

Skills

Incident response

Digital forensics

Threat intelligence

Python

PowerShell

Analytical thinking

Communication

Teamwork

Education

Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, or related field

Tools

EnCase

FTK

X-Ways

Volatility

Job description

# DFIR Analyst3 to 6Abu Dhabi officeFull-Time• Lead and participate in all phases of the incident response lifecycle, including preparation, detection and analysis, containment, eradication, recovery, and post incident activity. • Conduct in-depth digital forensic investigations to identify the root cause, scope, and impact of security incidents. • Collect, preserve, and analyze digital evidence from various sources (e.g., endpoints, networks, cloud environments). • Utilize forensic tools and techniques to reconstruct events, identify attacker methodologies, and attribute threats. • Develop and implement incident containment and eradication strategies. • Prepare detailed incident reports, including technical findings, remediation recommendations, and lessons learned. • Collaborate with internal teams (e.g., IT, legal, compliance) and external partners (e.g., law enforcement, third-party vendors) during incident response efforts. • Contribute to the development and improvement of DFIR processes, playbooks, and tools. • Stay current with the latest threat intelligence, attack techniques, and forensic methodologies. • Provide training and mentorship to junior team members. Qualifications • Bachelor's degree in Computer Science, Cybersecurity, Digital Forensics, or a related field (or equivalent practical experience). • Minimum of 3-5 years of experience in digital forensics and incident response. • Strong understanding of operating systems (Windows, Linux, macOS), network protocols, and cloud platforms. • Proficiency with industry-standard forensic tools (e.g., EnCase, FTK, X-Ways, Volatility) and incident response platforms. • Experience with scripting languages (e.g., Python, PowerShell) for automation and analysis. • In-depth knowledge of common attack vectors, malware analysis, and threat intelligence. • Excellent analytical, problem-solving, and critical thinking skills. • Strong written and verbal communication skills, with the ability to present complex technical information clearly and concisely. Preferred Certifications (one or more of the following) • GIAC Certified Incident Handler (GCIH) • GIAC Certified Forensic Examiner (GCFE) • GIAC Reverse Engineering Malware (GREM) • CompTIA CySA+ • EC-Council Certified Incident Handler (ECIH) Skills • Technical Skills: • Digital evidence collection and preservation • Malware analysis • Network forensics • Host forensics • Memory forensics • Cloud forensics • Log analysis • Threat hunting • Vulnerability management • Soft Skills: • Calmness under pressure • Attention to detail • Problem-solving • Communication (written and verbal) • Teamwork and collaboration • Adaptability • Critical thinkin