Senior Consultant - Incident Response (CPX)

CPX; Abu Dhabi; On-site; AED 250,000 - 350,000; Full time

Job summary

CPX seeks a Senior Incident Responder to join the Incident Response & Forensics Team in a high-impact cyber defence environment. You will lead active IR engagements, perform DFIR across Windows, Linux, and Mac, and communicate findings to clients with strong English.

You will also drive threat hunting, create remediation plans, and contribute to lab maintenance and internal knowledge sharing in a fast-paced setting.

Qualifications

• Minimum 3–5 years of incident response and digital forensics experience
• Fluent English speaking and written communication to stakeholders
• GIAC cert in GNFA, GCIH, GCIA, GCFE, GCFA or equivalent
• Bachelor's degree in Computer Science or Engineering desirable
• Previous experience performing digital forensics is a must

Responsibilities

• Serve as technical lead on active incident response engagements
• Communicate investigation progress to clients with clear English
• Execute threat hunting activities in support of IR and SOC
• Perform host and/or network forensics across Windows, Mac and Linux
• Conduct digital forensic investigations for IR engagements
• Contribute to process documentation and service improvements
• Produce detailed reports and briefs for customers
• Explain findings to technical and non-technical stakeholders
• Lead internal knowledge sharing sessions on DFIR topics
• Be SME on one or more verticals (host/network/mobile forensics, malware analysis, cloud forensics, OT/ICS)
• Work independently within the team after initial ramp-up
• Maintain the DFIR forensics lab and tools

Skills

Blue team operations

Incident response

Digital forensics

Network protocols

Windows knowledge

Linux/OSX

Malware analysis

ATT&CK framework

Threat hunting

Documentation

Communication

Education

Bachelor's degree in Computer Science or Engineering

GIAC/GNFA/GCIH/GCIA/GCFE/GCFA or equivalent

eLearnSecurity or equivalent

Job description

As a Senior Incident Responder in the Incident Response & Forensics Team within a high-impact and operationally critical cyber defence environment, you live and breathe blue team operations. Your technical expertise in digital forensics and cyber incident response is well complemented by your integrity and passion for cyber security and technology in general. You work well in a team of highly motivated and skilled blue teamers, but you can also achieve your work independently in different engagements and scenarios. You enjoy taking on new challenges in a fast paced and dynamic working environment. You are a team player who is always willing to help out where required, with a humble and positive attitude.

Responsibilities

• At least 3-5 years of experience in all (or at least most) of the following activities. Serve as technical lead on active incident response engagements.
• English communication skills and stakeholder management skills are a important to communicate investigation progress to clients
• Execute threat hunting activities in support of incident response engagements and SOC activities
• Perform host and/or network-based forensics across Windows, Mac and Linux platforms
• Execute digital forensic investigations supporting cyber incident response engagements
• Contribute to process documentation and continuous service improvement activities
• Produce detailed reports and technical briefs, effectively communicate tasks, methodology and guidance to customers
• Explain technical findings in a manner that can be easily understood by technical and non-technical stakeholders
• Demonstrate industry thought leadership through internal brown-bag sessions
• Perform research activities in search of service improvement tasks and threat landscape better understanding
• Help maintain the client-fostered DFIR Forensics Lab
• Be the team’s subject matter expert on at least one of the following verticals: host forensics, network forensics, mobile forensics, malware analysis, OT/ICS Incident Response, cloud forensics, threat hunting. Ability to achieve tasks independently within the team after initial 3 months. Flexible schedule that is open to changing situations and opportunities. You must be a team player, with a humble and approachable nature who is willing to go the extra mile.

Technical Skills

• Strong understanding of blue team operations, incident response management and digital forensics techniques
• Sound understanding of network protocols, TCP/IP etc.
• Sound understanding of Microsoft Windows
• Sound understanding of Linux and OSX
• Sound forensic skills across multiple operating systems
• Understanding of network analysis tools like Bro/Zeek, Rita or Suricata
• Ability to perform analysis of system and network devices logs
• Understanding of modern mobile devices and their OS
• Understanding of the capabilities of static and dynamic malware analysis
• Sound understanding of enterprise systems, technologies, and infrastructure
• Sound understanding of targeted attacks and able to create customized tactical and strategic remediation plans for compromised organizations
• Strong understanding of current threats, vulnerabilities, and attack trends
• Strong understanding of ATT&CK framework
• Understanding of AI security processes & ability to use AI properly within IR investigations
• Excellent organisational skills, ability to prioritise, and ability to work independently
• Ability to learn quickly and apply the learnings into the job on a day-to-day basis

Qualifications

• Good attention to detail and reporting accuracy, good stakeholder management & communication skills; excellent English language skills, both spoken and written
• English language skills, both spoken and written
• GIAC Certified in a minimum of one discipline: GNFA, GCIH, GCIA, GCFE, GCFA, GDAT, etc
• Or equivalent (eLearnSecurity .etc)
• Previous experience performing digital forensics is A MUST
• Previous experience performing digital forensics is a must
• Bachelor's degree in Computer Science or Engineering desirable, but not mandatory