Telecom Incident Response Engineer: Unix/Linux Forensics

RecruitMe Plus; Dubai; On-site; AED 250,000 - 450,000; Full time

Job summary

RecruitMe Plus in Dubai seeks an Incident Response Security Engineer to lead host-based investigations and compromise assessments across Unix/Linux and Windows environments. You will analyze telecom protocols (SS7, SIP, Diameter, VoIP) and triage artifacts at scale, guiding containment and remediation of advanced threats within production telecom infrastructure.

Collaborating with operations teams, you will refine investigation playbooks, produce technical reports, and train SOC staff to

Qualifications

• Experience in telecom incident response and protocols.
• Hands-on host-based investigations on Unix/Linux and Windows.
• Familiar with telecom signaling systems and related artifacts.
• Experience with creating or using UAC scripts for data collection.

Responsibilities

• Investigate security incidents in telecom environments across core network and signaling platforms.
• Analyze incidents involving telecom protocols and systems (e.g., SS7, SIP, Diameter, VoIP, signaling infrastructure).
• Lead deep host-based investigations on compromised systems.
• Conduct advanced investigations on Unix/Linux-based systems and supporting services.
• Lead and support compromise assessments to determine attacker presence, persistence, and lateral movement.
• Execute large-scale artifact triage across enterprise Windows and Linux fleets.
• Identify indicators of compromise (IOCs), attacker techniques, and affected assets.
• Collect and analyze host artifacts such as logs, processes, memory, persistence mechanisms, and network connections.
• Use and customize UAC (Unix-like Artifacts Collector) scripts for scalable evidence collection.
• Ensure forensic soundness and proper evidence handling.
• Recommend and execute containment strategies tailored to telecom infrastructure and production systems.
• Support eradication of malicious artifacts and validate system integrity post-remediation.
• Work closely with operations teams to minimize service disruption.
• Threat Hunting & Proactive Detection: conduct proactive threat hunting across Unix/Linux and Windows systems using known TTPs and telecom-specific threat models.
• Correlate host-based findings with network and signaling activity.
• Incident Response Process & Playbooks: contribute to the development and refinement of incident response playbooks for telecom environments.
• Improve investigation workflows for host-based and large-scale incident scenarios.
• Reporting, Collaboration & Knowledge Transfer: produce clear technical reports detailing findings, impact, and remediation actions.
• Brief stakeholders, SOC teams, and leadership on incident scope and risk.
• Share investigation techniques and lessons learned to strengthen detection capabilities.

Skills

Telecommunications incident response

Unix-based investigations

Windows investigations

Artifact triage

Threat hunting

Tools

UAC scripts

Job description

RecruitMe Plus in Dubai seeks an Incident Response Security Engineer to lead host-based investigations and compromise assessments across Unix/Linux and Windows environments. You will analyze telecom protocols (SS7, SIP, Diameter, VoIP) and triage artifacts at scale, guiding containment and remediation of advanced threats within production telecom infrastructure.

Collaborating with operations teams, you will refine investigation playbooks, produce technical reports, and train SOC staff to