Incident Response Security Consultant, Mandiant

Forensic Focus; United Arab Emirates; On-site; AED 350,000 - 550,000; Full time

Job summary

Forensic Focus in the United Arab Emirates seeks an experienced incident responder to lead complex, high-profile IR engagements for enterprise clients. You will oversee host and network forensics, cloud evidence examination, log analysis, malware triage, and threat hunting, delivering clear, actionable reports.

You will develop presentations for technical and executive stakeholders, mentor junior colleagues, and travel up to 30% across the region to support engagements.

Qualifications

• At least three years of investigative experience across network, disk and memory forensics, cloud forensics, or malware triage.
• Three years of end-to-end incident response (IR) experience.
• Preferred certifications include GCFA, GCFE, GNFA, GREM, GCIH, and GX-FA; familiarity with cloud platforms and CTF environments.

Responsibilities

• Lead complex, high-profile incident response engagements for enterprise clients.
• Perform host and network forensics, cloud evidence examination, and log analysis.
• Triage malware, conduct threat hunting, and prepare comprehensive reports and executive presentations.
• Communicate findings to both technical teams and senior leadership.

Skills

Network forensics

Disk forensics

Memory forensics

Cloud forensics

Malware triage

Incident response

Job description

The Role

This consultant-level position involves leading complex, high-profile incident response engagements for enterprise clients. Day-to-day responsibilities include host and network forensics, cloud evidence examination, log analysis, malware triage, threat hunting, and the development of comprehensive reports and presentations for both technical and executive stakeholders.

Skills & Experience

Candidates need at least three years of investigative experience across network forensics, disk and memory forensics, cloud forensics, or malware triage, combined with three years of end-to-end IR experience. Preferred certifications include GCFA, GCFE, GNFA, GREM, GCIH, and GX-FA, alongside familiarity with cloud platforms and CTF environments.

Who It Suits

This role suits an experienced incident responder with strong forensic foundations who is comfortable advising clients under pressure, communicating findings to senior leadership, mentoring junior colleagues, and travelling up to 30% of the time across the region.