Lead DFIR Incident Responder – Flexible Schedule

CPX; Abu Dhabi; On-site; AED 180,000 - 260,000; Full time

Job summary

CPX is seeking a Lead Incident Responder to join the Incident Response & Forensics Team in Abu Dhabi. You will lead active IR engagements, coordinate with clients, and drive threat hunting and forensics across Windows, Linux, and Mac environments.

You will craft detailed reports, mentor juniors, and help shape improvement initiatives while maintaining strong stakeholder communication and lab oversight.

Qualifications

• Must have previous digital forensics experience.
• Experience with malware analysis is desirable.
• GIAC certs in GNFA, GCIH, GCIA, GCFE, GCFA or GDAT preferred.
• Excellent English communication and stakeholder management skills.
• Bachelor's degree in CS/Engineering desirable but not mandatory.

Responsibilities

• Lead active incident response engagements as technical and coordination lead.
• Coordinate with clients and staff and report progress to stakeholders.
• Execute threat hunting in IR engagements and SOC activities.
• Perform host and network forensics on Windows, Linux and Mac platforms.
• Produce detailed reports and briefs, and perform QA on team outputs.
• Contribute to process documentation and service improvements.
• Lead internal knowledge sessions and research for improvements.
• Maintain the DFIR Lab and be SME on two verticals.

Skills

Blue team operations

Threat hunting

Windows

Linux

MacOS

Forensics

Malware analysis

ATT&CK

Network analysis

Communication

Stakeholder management

Education

Bachelor's degree in Computer Science or Engineering

Equivalents (eLearnSecurity)

Tools

Bro/Zeek

Rita

Suricata

Job description

CPX is seeking a Lead Incident Responder to join the Incident Response & Forensics Team in Abu Dhabi. You will lead active IR engagements, coordinate with clients, and drive threat hunting and forensics across Windows, Linux, and Mac environments.

You will craft detailed reports, mentor juniors, and help shape improvement initiatives while maintaining strong stakeholder communication and lab oversight.