Senior DFIR Lead - Incident Response & Forensics

Forensic Focus Limited; Abu Dhabi; On-site; AED 350,000 - 550,000; Full time

Job summary

Forensic Focus Limited is seeking a Senior Consultant to lead active incident response engagements in Abu Dhabi. You will conduct host and network forensics, perform threat hunting, and analyze logs while reporting findings to stakeholders.

The role requires 3–5 years of DFIR experience across Windows, Linux, and macOS, plus GIAC certifications and the ability to communicate complex results clearly to technical and non-technical audiences.

Qualifications

• 3–5 years hands-on DFIR experience across Windows, Linux and macOS forensics.
• Experience with network analysis tools: Zeek, Rita or Suricata.
• Malware analysis experience is required.
• At least one GIAC certification (GNFA, GCIH, GCFA, GCFE or equivalent) is required.
• Strong English communication and stakeholder management skills.

Responsibilities

• Lead active IR engagements within the Incident Response and Forensics team.
• Conduct host and network forensic investigations and threat hunting activities.
• Perform log analysis, generate stakeholder reports and contribute to a DFIR lab.
• Drive continuous service improvement through findings and lessons learned.

Skills

DFIR experience

Windows forensics

Linux forensics

macOS forensics

GIAC certs

Zeek

Rita

Suricata

Malware analysis

Job description

Forensic Focus Limited is seeking a Senior Consultant to lead active incident response engagements in Abu Dhabi. You will conduct host and network forensics, perform threat hunting, and analyze logs while reporting findings to stakeholders.

The role requires 3–5 years of DFIR experience across Windows, Linux, and macOS, plus GIAC certifications and the ability to communicate complex results clearly to technical and non-technical audiences.