Incident Response Lead (DFIR), UAE

Forensic Focus Limited; Dubai; On-site; AED 320,000 - 520,000; Full time

Job summary

Forensic Focus Limited in Dubai seeks a seasoned DFIR professional to lead cybersecurity incident response activities across enterprise environments, covering triage, containment, eradication and recovery. You will drive investigations from detection through remediation.

Day-to-day work includes conducting digital forensic investigations, performing root-cause analysis, coordinating with SOC and IT teams, developing response playbooks, and supporting threat hunting initiatives.

Qualifications

• 5–7 years in cybersecurity with hands-on DFIR experience.
• Proficient with SIEM, EDR, and security monitoring tools.
• Strong knowledge of Windows, Linux, and networking.
• Cloud IR experience is a plus; scripting in Python or PowerShell preferred.

Responsibilities

• Lead DFIR investigations across enterprise environments.
• Triage, containment, eradication, and recovery activities.
• Perform digital forensic investigations and root cause analysis.
• Coordinate with SOC and IT teams for incident response.
• Develop response playbooks and support threat hunting initiatives.

Skills

DFIR expertise

Malware analysis

Ransomware investigations

Phishing investigations

SIEM / EDR tooling

Windows

Linux

Networking knowledge

Python scripting

PowerShell scripting

Education

GCFA

GCIH

GCFE

CHFI

CEH

CySA+

Security+

Tools

SIEM tooling

EDR tooling

Threat hunting tooling

Job description

The Role

This Dubai-based position centres on leading cybersecurity incident response activities across enterprise environments, covering triage, containment, eradication, and recovery. Day-to-day work includes conducting digital forensic investigations, performing root cause analysis, coordinating with SOC and IT teams, developing response playbooks, and supporting threat hunting initiatives.

Skills & Experience

Candidates need five to seven years in cybersecurity with strong hands-on DFIR expertise, including malware, ransomware, and phishing investigation. Proficiency with SIEM, EDR, and security monitoring tools is essential, alongside solid knowledge of Windows, Linux, and networking. Relevant certifications include GCFA, GCIH, GCFE, CHFI, CEH, CySA+, or Security+. Cloud IR experience and scripting skills in Python or PowerShell are advantageous.

Who It Suits

This role suits a seasoned DFIR professional who thrives under pressure, communicates clearly with both technical and business stakeholders, and takes ownership of complex investigations from detection through to remediation. Those with an appetite for continuous improvement and threat hunting will find the position particularly rewarding.