Lead Cyber Forensics & Incident Response Engineer

e& UAE; Abu Dhabi; On-site; AED 400,000 - 660,000; Full time

Job summary

e& UAE is seeking a senior security professional to lead incident response, host-level investigations, and comprehensive digital forensics across on-premises and cloud environments. You will proactively hunt threats, develop playbooks, and produce actionable reports for security teams and management.

Required are 6+ years in DFIR/IR/Threat Hunting, strong skills with Windows/Linux logs, and certifications (SANS/GCFA/GCFE/GCIH). Experience with Microsoft Sentinel and Splunk preferred.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, or related field (or equivalent work experience)
• Investigation background must include host-level investigations, not just EDR/SIEM
• Hands-on experience with Windows and Linux environments and log analysis
• Strong hands-on experience with Incident Response and Digital Forensics
• Practical end-to-end investigation/case handling exposure
• Docker OR Kubernetes
• DFIR related certifications
• SANS certifications (GCFA/GCFE/GCIH preferred)
• 6+ years in digital forensics, incident response, or threat hunting
• Expertise in Digital Forensics, Incident Response, and Threat Hunting

Responsibilities

• Monitor and analyze threat intelligence to stay informed on threats and vulnerabilities
• Conduct forensic investigations for cybersecurity incidents including data breaches and APTs
• Use forensic tools to collect and analyze evidence with chain-of-custody
• Analyze security events from SIEM, IDS/IPS, firewalls, EDR, and network data
• Develop advanced threat-hunting queries and custom searches to detect evasion
• Perform host-based forensics on Windows, Linux, macOS, and mobile devices
• Perform network forensics using NDR and Security Onion
• Initial malware analysis to assess risk
• Hunt for IOCs and TTPs to identify adversaries
• Build and refine threat-hunting playbooks and runbooks
• Communicate findings via reports and presentations to security teams and stakeholders
• Experience with FTK, EnCase, Oxygen, Cellebrite, etc.
• Develop remediation strategies for compromised environments
• Develop scripts to automate security log analysis
• Conduct cloud incident response across Azure & AWS
• Map threats using MITRE ATT&CK framework
• Ensure incidents close per SLA requirements

Skills

Incident Response

Digital Forensics

Threat Hunting

KQL

Windows & Linux logs analysis

DFIR certifications

SANS certifications

Education

Bachelor’s degree in Cybersecurity, Computer Science, or related field

Tools

Docker

Kubernetes

Microsoft Sentinel

Splunk

Job description

e& UAE is seeking a senior security professional to lead incident response, host-level investigations, and comprehensive digital forensics across on-premises and cloud environments. You will proactively hunt threats, develop playbooks, and produce actionable reports for security teams and management.

Required are 6+ years in DFIR/IR/Threat Hunting, strong skills with Windows/Linux logs, and certifications (SANS/GCFA/GCFE/GCIH). Experience with Microsoft Sentinel and Splunk preferred.