Incident Responder (UAE)

Outbreach Ltd.; United Arab Emirates; Hybrid; AED 495,000 - 605,000; Full time

Benefits offered by this job

Hybrid working

Flexible hours

Training budget

Stock options

Job summary

Outbreach Ltd. is seeking an experienced Incident Responder to lead the restoration of client IT systems after cyber-attacks. The role requires coordinating with Incident Managers and cross-functional experts to deliver rapid, thorough responses.

You will assess damages, implement temporary infrastructure, collect artefacts, and perform root-cause analyses while ensuring remediation of vulnerabilities. Hybrid work and ongoing training are offered.

Qualifications

• 3+ years as a cyber incident responder.
• 5+ years in a technical support or engineering role.
• Strong knowledge of operational security across cloud providers.
• Certifications such as GCIH, GCIA or GCFA/E.
• Experience with Business Continuity and Disaster Recovery.
• Strong communication skills for clients and executives.

Responsibilities

• Lead restoration of client IT systems after a cyber-attack.
• Triage initial incident calls with the Incident Manager.
• Assess IT state, report damage and exposure.
• Implement temporary infrastructure to sustain operations during incidents.
• Collect and analyse intrusion artefacts such as logs and malware.
• Conduct root-cause analysis of breaches and infections.
• Remediate vulnerabilities to prevent reinfection.
• Collaborate with Forensic, Legal, PR, Comms and third parties.
• Monitor external threats and document findings.

Skills

Cyber incident response

Technical support

Cloud security

MITRE ATT&CK

Disaster Recovery

Client communication

Education

Cybersecurity certifications (GCIH, GCIA, GCFA/E)

Tools

MITRE ATT&CK

Job description

United Arab Emirates (Remote) 550,000 AED On call

The Incident Responder (IR) is the main person responsible for the technical operational tasks necessary to provide our clients with a high quality, rapid and comprehensive response to a breach. They will be at the forefront of all incidents and absolutely critical to the successful resolution. They will be intimately familiar with a wide variety of attacks from Ransomware to BEC, insider threat and DDoS to name just a few examples.The IR will be expected to work closely with Incident Managers and feed information to/from specialists in other areas of the incident response such as forensic, legal or PR.The IR will be able to handle pressure, multiple conflicting demands, and possibly chaotic environments with limited knowledge of the company or crisis. They will be expected to help bring order to the incident and contribute to the swift attainment of the client’s objectives.

Key Responsibilities

• First and foremost, this role is responsible for leading the restoration of our client’s IT systems after a cyber-attack.
• Working with the Incident Manager to help triage an initial call.
• Assess the state of the IT systems, report on the damage incurred and any other exposure.
• Implement temporary infrastructure to sustain key business operations during the incident.
• Collect and analyse intrusion artefacts such as logs, source code, malware etc.
• Conduct a root cause analysis to determine how the attack happened, any lateral movement or infection.
• Fully ‘clean’ and remove any residual infection, malware or other damage caused by the attacker.
• Ensure that vulnerabilities are remediated to prevent future reinfection by the same or similar method.
• Collaborate with Forensic, Legal, PR, Comms and 3 rd parties to ensure a comprehensive response.
• Monitor external sources to determine threats, evidence of breaches and breach impact.
• Document response activities, findings and recommendations.

Non-Incident Response / Crisis Management Responsibilities

• Engage with proactive audit and investigations to plan for a breach.
• Conduct threat hunting and other pre-breach or breach confirmation operations.
• Help to refine and improve playbooks, runbooks, and overall response methodology.

Skills & Experience

• 3+ years as a cyber incident responder.
• 5+ years in a technical support or engineering role (or demonstrable advanced technology knowledge).
• Strong knowledge of operational security across multiple platforms and all major cloud providers.
• Certifications such as GCIH, GCIA or GCFA/E.
• Huge passion for cyber security demonstrated by research, testing or other activities.
• Advanced knowledge of MITRE Att&ck framework and common TTPs.
• Extensive experience with Business Continuity and Disaster Recovery.
• Incredibly methodical and attentive to the smallest of details.
• Strong communication skills and presentable to clients and senior executives.

Highly Desirable but not Vital

• Experience gained from a consultancy or highly regulated organisation.
• Experience working in a 24/7 operation.
• Previous experience as a SOC analyst or Red Team.
• Risk and Compliance practices.
• Working knowledge of Public Relations, Communications, Marketing and Law.
• Experience within high pace, high pressure environments and desire to work in incidents and crisis management.
• Security Clearance.

Commitment

As a ‘bench’ Incident Responder you will be called whenever a suitable incident is raised by our clients which matches with your skill and experience level.

There is no expectation for you to remain on call or for you to accept any incident when you are not available. However, once you commit to an incident you will become a key member of the response team and will be expected to remain engaged for the duration of the incident. At the least this would be for 1 day, but in most cases will likely be for 2-4 weeks.

Full training and support will be provided to successful candidates who will be expected to attend regular (paid) meetings to ensure they are familiar with the company, its methodologies and market.

• Hybrid working with much of your work being done where you please.
• Flexible hours that can be scaled up or down as suits you.
• Working in an expanding Cyber Security business where you can grow in your career and where you can help shape the business.
• Training and development budget aligned to formal relevant qualifications.
• Hourly pay equivalent to over AED550,000pa with a significant increase for unsociable hours – if needed.
• Eligible for company stock options (subject to minimum hours).