Senior Consultant – Incident Response

Forensic Focus Limited; Abu Dhabi; On-site; AED 350,000 - 550,000; Full time

Job summary

Forensic Focus Limited is seeking a Senior Consultant to lead active incident response engagements in Abu Dhabi. You will conduct host and network forensics, perform threat hunting, and analyze logs while reporting findings to stakeholders.

The role requires 3–5 years of DFIR experience across Windows, Linux, and macOS, plus GIAC certifications and the ability to communicate complex results clearly to technical and non-technical audiences.

Qualifications

• 3–5 years hands-on DFIR experience across Windows, Linux and macOS forensics.
• Experience with network analysis tools: Zeek, Rita or Suricata.
• Malware analysis experience is required.
• At least one GIAC certification (GNFA, GCIH, GCFA, GCFE or equivalent) is required.
• Strong English communication and stakeholder management skills.

Responsibilities

• Lead active IR engagements within the Incident Response and Forensics team.
• Conduct host and network forensic investigations and threat hunting activities.
• Perform log analysis, generate stakeholder reports and contribute to a DFIR lab.
• Drive continuous service improvement through findings and lessons learned.

Skills

DFIR experience

Windows forensics

Linux forensics

macOS forensics

GIAC certs

Zeek

Rita

Suricata

Malware analysis

Job description

# Senior Consultant – Incident Response*CPX***Abu Dhabi, Abu Dhabi Emirate**Onsite · Senior · Full-time### The RoleThis position sits within a dedicated Incident Response and Forensics team, where the successful candidate leads active IR engagements, conducts host and network forensic investigations, and executes threat hunting activities. Day-to-day work includes log analysis, stakeholder reporting, contributing to a DFIR lab, and driving continuous service improvement.### Skills & ExperienceCandidates need 3–5 years of hands-on DFIR experience covering Windows, Linux and macOS forensics, network analysis tools such as Zeek, Rita or Suricata, and malware analysis. At least one GIAC certification (GNFA, GCIH, GCFA, GCFE or equivalent) is required, alongside strong English communication and stakeholder management skills.### Who It SuitsThe role suits an experienced DFIR practitioner who thrives in fast-paced, operationally critical environments, is comfortable leading investigations independently, and can communicate complex technical findings clearly to both technical and non-technical audiences. A team-oriented, adaptable mindset is essential.Compare Incident Response salaries in United Arab Emirates →Certifications mentioned:GCFA · GCFE · GNFA · GCIH — find training for these on theDFIR Training Finder.Learn More/Apply