Digital Forensics and Incident Response Consultant (UAE)

Forensic Focus; Asia; Remote; PEN 515,000 - 902,000; Part time

Job summary

Forensic Focus seeks a senior Digital Forensics and Incident Response consultant for a remote, contract-based position in the UAE. The freelance role involves live-incident investigations across endpoints, servers, memory, network and cloud, with responsibility for triage, timeline construction, and detailed evidentiary reporting.

Ideal candidates have 5+ years in cybersecurity, 3+ hands-on DFIR experiences, and strong scripting and reporting abilities.

Qualifications

• Minimum five years in cybersecurity with at least three hands-on DFIR experience.
• Proficiency with DFIR tooling and cloud, network, and endpoint investigations.
• Strong report-writing ability and scripting skills are valued.

Responsibilities

• Acquire forensic evidence across endpoints, servers, memory, network and cloud during live incidents.
• Triage compromises, build timelines from artefacts, investigate intrusions in Microsoft 365 and cloud environments, scope data exfiltration.
• Write evidential reports for clients, insurers, lawyers and regulators.

Skills

DFIR

Incident response

Forensic analysis

Education

GCFA

GCFE

GREM

GCIH

GNFA

Tools

Velociraptor

KAPE

X-Ways

Magnet AXIOM

EnCase

FTK

Volatility

Job description

# Digital Forensics and Incident Response Consultant (UAE)*Outbreach***United Arab Emirates**Remote · Senior · Contract### The RoleThis freelance bench role involves acquiring forensic evidence across endpoints, servers, memory, network and cloud environments during live incidents. The consultant triages compromises, builds timelines from artefacts, investigates Microsoft 365 and cloud intrusions, scopes data exfiltration, and writes evidential reports for clients, insurers, lawyers and regulators.### Skills & ExperienceRequires at least five years in cyber security, three hands-on in DFIR, with proficiency in tools such as Velociraptor, KAPE, X-Ways, Magnet Axiom, EnCase, FTK or Volatility, plus SIEM and KQL skills. Certifications like GCFA, GCFE, GNFA, GREM or GCIH are valued, alongside scripting and strong report-writing ability.### Who It SuitsSuited to experienced DFIR practitioners who want flexible, engagement-based work rather than a permanent or on-call position, and who are comfortable handling ransomware, BEC and insider cases independently alongside an incident manager.Compare Digital Forensics salaries in United Arab Emirates →Certifications mentioned:GCFA · GCFE · GREM · GNFA · GCIH — find training for these on theDFIR Training Finder.Learn More/Apply