Expert Engineer/Security Operation Centre

Forensic Focus; Abu Dhabi; On-site; AED 350,000 - 550,000; Full time

Job summary

Forensic Focus in Abu Dhabi is seeking a Senior Expert Engineer to join our Security Operations Centre on-site. The role centers on end-to-end forensic investigations, incident response, and SOC operations in a high-pressure environment.

You will perform host-based and network forensics, malware triage, and threat hunting using MITRE ATT&CK, with cloud IR across AWS and Azure, producing high-quality reports for technical and non-technical stakeholders while meeting SLA requirements.

Qualifications

• 6+ years of DFIR experience with hands-on use of EnCase, FTK, Cellebrite, Oxygen, and Volatility.

Responsibilities

• Conduct end-to-end DFIR investigations and incident response.

Skills

DFIR

EnCase

FTK

Cellebrite

Volatility

SIEM

Sentinel

Splunk

KQL

Python

PowerShell

Docker

Kubernetes

Tools

Sentinel

Splunk

Docker

Kubernetes

Job description

# Expert Engineer/Security Operation Centre*e& UAE***Abu Dhabi, Abu Dhabi Emirate**Onsite · Senior · Full-time### The RoleThe position sits within a security operations centre and covers end-to-end forensic investigations and incident response. Day-to-day work includes host-based and network forensics, malware triage, threat hunting using MITRE ATT&CK, cloud IR across AWS and Azure, and producing high-quality reports for technical and non-technical stakeholders while meeting SLA requirements.### Skills & ExperienceCandidates need at least six years of DFIR experience with strong hands-on use of EnCase, FTK, Cellebrite, Oxygen and Volatility, plus SIEM platforms such as Sentinel and Splunk. SANS certifications — particularly GCFA, GCFE and GCIH — are required, alongside KQL query writing, Python or PowerShell scripting, and familiarity with Docker or Kubernetes.### Who It SuitsThis role suits an experienced DFIR practitioner who thrives in high-pressure SOC environments, is equally comfortable conducting deep host-level investigations and cloud forensics, and can clearly communicate complex findings to diverse audiences. Those with broad investigation exposure beyond EDR and SIEM tooling will be particularly well placed.