DFIR Lead | Dubai | AED 35,000-38,000 per month + Benefits

Edison Smart®; Dubai; Hybrid; AED 391,000 - 424,000; Full time

Benefits offered by this job

Medical insurance for employee

Hotel accommodation for relocation

Hybrid working

Job summary

Edison Smart® in Dubai seeks a Digital Forensics & Incident Response Lead to guide a DFIR team and manage complex investigations, threat hunting and remediation engagements. You will direct incidents end-to-end, including ransomware scenarios, and communicate findings to senior stakeholders.

The role combines hands-on leadership with customer-facing delivery, including international travel when required, with a relocation hotel allowance.

Qualifications

• 10+ years’ information security experience with incident response, forensics, security operations or malware analysis.
• At least 2–3 years in a senior or lead capacity, mentoring analysts and guiding engagements.
• Experience handling ransomware and APT investigations using established IR methodologies.
• Strong forensic investigation skills and experience analyzing logs across endpoints, apps and networks.
• Malware analysis and reverse engineering with detection rule development using YARA, Sigma or Snort.
• Understanding attacker techniques, enterprise threat hunting, networking and TCP/IP.
• Scripting in Python, PowerShell or Bash.
• A relevant degree and one or more: CISSP, GCIA, GCIH, GCFA, GCFE, GREM or OSCP.

Responsibilities

• Lead, mentor and develop the DFIR team, overseeing daily activities and technical delivery.
• Lead incident response engagements from triage and containment through eradication and remediation.
• Conduct forensic investigations across endpoints, memory, disk images, network traffic and logs to establish root cause and attack scope.
• Analyse malware, identify indicators of compromise and develop detection content.
• Build scripts, tools and threat hunting queries to improve response capabilities.
• Develop incident response plans tailored to customer environments.
• Coordinate with technical teams, legal stakeholders and senior management during live incidents.
• Deliver clear customer reports covering findings and remediation recommendations.
• Support on-site customer engagements, including international travel when required.

Skills

Incident response

Digital forensics

Threat hunting

Malware analysis

Detection rule development

Python

PowerShell

Bash

Communication with stakeholders

Education

CISSP/GCIA/GCIH/GCFA/GCFE/GREM/OSCP

Tools

YARA

Sigma

Snort

Job description

I’m working with an established cybersecurity services provider looking to appoint a Digital Forensics & Incident Response Lead in Dubai.

This is a hands‑on leadership opportunity combining team management with complex forensic investigations, threat hunting and incident response engagements. You’ll lead the DFIR team and guide customers through major security incidents, including ransomware and advanced persistent threats.

Location: Dubai

Employment: Permanent

Salary: AED 35,000–38,000 per month

Relocation support: One month’s initial hotel accommodation

The role

• Lead, mentor and develop the DFIR team, overseeing daily activities and technical delivery.
• Lead incident response engagements from triage and containment through eradication and remediation.
• Conduct forensic investigations across endpoints, memory, disk images, network traffic and logs to establish root cause and attack scope.
• Analyse malware, identify indicators of compromise and develop detection content.
• Build scripts, tools and threat hunting queries to improve response capabilities.
• Develop incident response plans tailored to customer environments.
• Coordinate with technical teams, legal stakeholders and senior management during live incidents.
• Deliver clear customer reports covering findings and remediation recommendations.
• Support on‑site customer engagements, including international travel when required.

What we’re looking for

• 10+ years’ information security experience, with substantial exposure to incident response, digital forensics, security operations or malware analysis.
• At least 2–3 years in a senior or lead capacity, mentoring analysts and guiding incident response engagements.
• Experience handling ransomware and APT investigations, using SANS or a comparable incident response methodology.
• Strong forensic investigation skills and experience analysing system, application and security logs.
• Malware analysis and reverse engineering experience, alongside detection rule development using YARA, Sigma or Snort.
• Strong understanding of attacker techniques, enterprise threat hunting, networking and TCP/IP.
• Scripting capability in Python, PowerShell or Bash.
• A relevant degree and at least one of: CISSP, GCIA, GCIH, GCFA, GCFE, GREM or OSCP.
• Confidence managing customer relationships and communicating technical findings to senior stakeholders.
• Medical insurance for the employee.
• One month’s initial hotel accommodation.
• Flexible/hybrid working arrangements.
• Learning, development and career progression opportunities.