Lead – Incident Response & Digital Forensics

CPX; Abu Dhabi Emirate; On-site; AED 700,000 - 1,200,000; Full time

Job summary

CPX seeks a senior, commercially minded Incident Response (IR) and Digital Forensics (DFIR) leader to protect government, critical infrastructure and enterprise clients in the UAE. The Director will act as CPX Incident Commander for major cyber incidents, guiding crisis response and shaping an intelligence‑led, AI‑enabled incident response service.

The role combines hands-on technical credibility with executive-reporting duties, business development and operational leadership to expand the IR

Qualifications

• 12–15+ years in cybersecurity with DFIR/major incident experience.
• 5+ years leading teams or practices.
• Incident Commander experience during major incidents.
• Expertise in enterprise, cloud, endpoint, network and identity investigations.
• Experience building or scaling a cyber services business.
• Strong judgement under pressure; executive communication.
• Bachelor’s degree in cybersecurity or related field; or equivalent.
• Experience with government, critical infrastructure or OT/ICS response.
• MSSP/consulting/CERT leadership; partner ecosystem.
• Cloud forensics, threat hunting, malware reverse engineering, AI-assisted SOC.

Responsibilities

• Serve as CPX Incident Commander for major cyber incidents.
• Lead multidisciplinary teams across DFIR, SOC, Threat Intelligence and legal.
• Direct investigations, containment, eradication and recovery planning.
• Brief executives and authorities with situation reports and risk assessments.
• Coordinate OT actions with client approval and operational constraints.
• Own IR/DFIR strategy, operating model and readiness.
• Develop playbooks, KPIs and partnerships; improve detections and response.
• Translate findings into client resilience and intelligence products.

Skills

Incident Response

DFIR

Crisis Leadership

Executive Communication

Client Engagement

Cybersecurity Strategy

Business Development

Education

Bachelor’s degree in cybersecurity

Tools

Cloud forensics

Threat Hunting

Job description

CPX is seeking a senior, commercially minded IR professional to lead its Incident Response (IR) and Digital Forensics (DFIR) practice. The successful candidate will combine hands‑on technical credibility, crisis leadership and business‑building capability to protect government, critical infrastructure and enterprise clients. The Director will serve as the designated CPX Incident Commander for major cyber incidents, leading coordinated response while growing an intelligence‑led, AI‑enabled incident response business.

Mandate Requirement: -

• Typically, 12-15+ years in cybersecurity, with substantial direct DFIR and major incident experience and 5+ years leading teams or practices.
• Proven record acting as Incident Commander or equivalent lead during complex, high‑severity cyber incidents.
• Deep expertise in enterprise, cloud, endpoint, network and identity investigations; familiarity with ransomware and advanced adversary tradecraft.
• Experience building or scaling a cyber services business, including commercial accountability, client engagement and operational performance.
• Strong judgement under pressure, executive communication and ability to coordinate technical and nontechnical stakeholders.
• Bachelor’s degree in cybersecurity, computer science, digital forensics or a related field, or equivalent demonstrable experience.
• Government, regulated industries, critical national infrastructure or OT/ICS response.
• MSSP, consulting, national CERT or specialist DFIR practice leadership; retainer and partner ecosystem development.
• Cloud forensics (Azure/AWS), threat hunting, malware reverse engineering and AI‑assisted security operations.
• Certifications such as GCFA, GCIH, GREM, GNFA, CISSP or CISM (valued, not mandatory).

Measures of Success

Effective major‑incident command and response readiness; investigation quality and client confidence; growth and profitability of the IR portfolio; retainer adoption; talent development; and measurable improvements from intelligence integration and responsible automation.

Key Responsibilities: -

Incident Command & Crisis Leadership

• Serve as CPX Incident Commander for major and critical cyber incidents, accountable for response strategy, command structure, prioritization, escalation, coordination and incident communications.
• Lead multidisciplinary teams spanning DFIR, SOC, Threat Intelligence, Threat Hunting, malware analysis, legal and client stakeholders; set clear objectives, roles, decision logs and reporting cadence.
• Direct investigations, containment, eradication and recovery planning for ransomware, identity compromise, data breaches, insider threats and sophisticated intrusions.
• Brief client executives and relevant authorities with accurate situation reports, business‑risk assessments and recommended actions; lead post‑incident reviews and improvements.
• For OT, safety‑critical or business‑disruptive actions, provide expert recommendations and coordinate decisions while respecting the client’s designated operational authority and approval requirements.

Practice Strategy, Operations & Governance

• Own the IR/DFIR strategy, operating model, service quality, 24/7 mobilization readiness and technical capability roadmap.
• Build expertise in endpoint, network, cloud and identity forensics, malware analysis, cyber crisis management and OT incident response.
• Maintain defensible forensic methodologies, chain of custody, evidence integrity, peer review and regulatory/contractual compliance.
• Develop response playbooks, exercises, quality controls, capacity plans, specialist partnerships and measurable service KPIs.
• Translate investigation findings into stronger SOC detections, proactive hunting, intelligence products and client resilience.
• Own the practice’s revenue, margin, utilization, delivery performance and agreed growth objectives.
• Scale incident response retainers, emergency response, forensic investigations, compromise assessments and readiness services.
• Partner with Sales, Presales and Account Management on strategic bids, proposals, pricing, client relationships and market development.
• Represent CPX as a trusted adviser to CISOs, executive leadership and government or critical‑infrastructure stakeholders.

Innovation & People Leadership

• Introduce secure AI‑assisted triage, forensic correlation, investigation workflows and reporting, with human oversight, auditability and evidence integrity.
• Recruit, coach and retain high‑performing incident responders and forensic specialists; build succession, training and a culture of accountability.
• Integrate IR with CPX Threat Intelligence, Threat Hunting and SOC teams to deliver a continuous intelligence‑to‑response improvement cycle.