Senior Incident Evidence Specialist

🏗 We're Hiring: Senior Incident Evidence Specialist

📍 Location: United Arab Emirates (Remote)

🕒 Employment Type: Full-Time

💼 Experience Level: Mid-Level to Senior

🌐 Work Arrangement: Fully Remote

About Us

We are a construction-focused organization committed to delivering complex projects through operational excellence, effective risk management, secure technology infrastructure, and collaborative project delivery. Our distributed teams work across Project Management, Construction, Engineering, Procurement, Commercial, Legal, Finance, Human Resources, Design, Quality, HSE, Consultants, Contractors, Suppliers, Logistics, Administration, Information Technology, and Executive Leadership to protect business-critical information, maintain operational resilience, and support secure project delivery.

As our organization relies on interconnected digital systems, cloud platforms, project management applications, and third-party technology services, maintaining reliable evidence of security incidents and other significant events is essential to effective investigations, accountability, and risk management. We value professionals who demonstrate technical precision, analytical thinking, confidentiality, and a disciplined approach to evidence handling and incident documentation.

The Role

We are seeking an experienced Senior Incident Evidence Specialist to manage the identification, collection, preservation, analysis support, documentation, and secure handling of digital evidence associated with cybersecurity incidents, suspected unauthorized access, data breaches, malware infections, insider threats, and other technology-related investigations.

The successful candidate will help ensure that incident evidence is collected through authorized methods, preserved with appropriate integrity controls, documented through a defensible chain of custody, and made available to authorized investigators and decision-makers. The role will collaborate closely with Security Operations, Digital Forensics, Incident Response, IT Infrastructure, Cloud Security, Legal, Compliance, Human Resources, Risk Management, and other relevant stakeholders.

The ideal candidate will have practical experience in digital evidence management, forensic acquisition procedures, log preservation, evidence integrity verification, incident case documentation, and secure evidence repositories. Strong attention to detail, sound technical judgment, and the ability to work with sensitive information under strict confidentiality requirements are essential.

Key Responsibilities1. Digital Incident Evidence Collection

• Coordinate the collection of digital evidence associated with cybersecurity incidents, suspected security breaches, unauthorized access, malware infections, and other approved investigations.
• Identify relevant evidence sources based on incident scope, investigation objectives, affected systems, and approved evidence collection plans.
• Collect or coordinate the collection of endpoint logs, system logs, application records, authentication events, network telemetry, email artifacts, cloud audit logs, and other relevant digital records.
• Support authorized acquisition of forensic images, file system artifacts, memory captures, configuration records, and other technical evidence where appropriate.
• Work with Incident Response and Digital Forensics teams to identify evidence requirements and prioritize time-sensitive collection activities.
• Ensure evidence collection is performed by authorized personnel using approved tools, documented procedures, and appropriate access controls.
• Record the source, collection method, collection date and time, collector identity, system details, and relevant contextual information for each evidence item.
• Verify that collected materials are associated with the correct incident, affected asset, user, or investigative reference.
• Identify incomplete, corrupted, inaccessible, or potentially unreliable evidence and coordinate appropriate corrective action.
• Avoid unnecessary alteration of source systems and preserve original evidence wherever practicable.
• Maintain accurate evidence inventories and collection records throughout the investigation lifecycle.
• Escalate circumstances that may threaten evidence integrity, availability, or timely preservation.

2. Evidence Preservation and Integrity

• Establish and maintain procedures for preserving digital evidence in a manner that supports integrity, traceability, confidentiality, and authorized future review.
• Generate and verify cryptographic hashes, such as SHA-256, for forensic images, files, exports, and other applicable evidence artifacts.
• Document hash values and verification results at appropriate points in the evidence lifecycle.
• Maintain original evidence separately from working copies where practicable and required by approved procedures.
• Ensure evidence is stored in approved repositories with appropriate encryption, access restrictions, and integrity protections.
• Monitor evidence storage conditions, retention requirements, access permissions, and repository availability.
• Identify evidence integrity discrepancies, unexplained changes, missing files, and other irregularities requiring investigation.
• Ensure evidence transfers are documented and performed using approved secure methods.
• Maintain procedures for creating verified working copies for analysis, review, and authorized disclosure.
• Coordinate periodic integrity checks where required by evidence handling standards and organizational procedures.
• Ensure that evidence remains traceable from initial collection through analysis, transfer, retention, and authorized disposal.
• Escalate suspected evidence tampering, unauthorized modification, loss, or disclosure through established incident channels.

3. Chain of Custody Management

• Establish, maintain, and verify chain-of-custody records for all evidence items under the specialist's responsibility.
• Record the identity of each individual collecting, receiving, accessing, transferring, or returning evidence.
• Document the date, time, purpose, method, and authorization associated with each custody transfer or material access event.
• Maintain unique evidence identifiers and consistent labeling across physical and digital evidence inventories.
• Verify that custody records are complete, chronological, internally consistent, and linked to the appropriate incident or case reference.
• Investigate gaps, discrepancies, missing acknowledgments, or unexplained custody changes.
• Ensure that evidence transfers between internal teams, external forensic providers, Legal, and other authorized recipients are properly documented.
• Maintain secure transfer and receipt procedures for evidence shared across locations or organizational boundaries.
• Support preparation of custody documentation for internal investigations, legal reviews, regulatory inquiries, and authorized proceedings.
• Ensure evidence handling follows applicable organizational policies, legal instructions, and relevant professional standards.
• Provide guidance to investigators and technical teams on the documentation required to maintain evidence traceability.
• Maintain auditable records of custody events throughout the approved retention period.

4. Cybersecurity Incident Evidence Support

• Support incident response teams by identifying, preserving, and organizing evidence relevant to active cybersecurity investigations.
• Coordinate evidence preservation for incidents involving phishing, business email compromise, ransomware, malware, account compromise, unauthorized access, and data exfiltration.
• Assist in identifying affected systems, user accounts, applications, network segments, cloud resources, and other relevant evidence sources.
• Preserve event timelines, alert records, security tool outputs, endpoint telemetry, authentication events, and other investigative artifacts.
• Work with incident responders to establish evidence collection priorities based on volatility, business impact, and the risk of data loss.
• Ensure that relevant logs and records are preserved before routine retention processes, system changes, or incident remediation make them unavailable.
• Coordinate with infrastructure teams to preserve relevant records during system rebuilds, migrations, configuration changes, and service recovery.
• Maintain a clear distinction between factual evidence, analytical interpretations, working hypotheses, and unverified assumptions.
• Provide organized evidence packages to authorized investigators to support root-cause analysis and incident reconstruction.
• Track outstanding evidence requests and follow up with responsible system owners and technical teams.
• Support post-incident reviews by ensuring that evidence supporting findings and corrective actions is properly referenced and retained.

5. Digital Forensic Acquisition Coordination

• Coordinate authorized forensic acquisition activities involving workstations, laptops, servers, removable media, virtual machines, and other supported computing assets.
• Work with qualified forensic practitioners to determine suitable acquisition methods based on system type, incident circumstances, and investigative objectives.
• Support the use of approved forensic tools for disk imaging, file acquisition, memory capture, and other relevant collection activities.
• Document acquisition parameters, tool versions, system identifiers, timestamps, hash values, and verification results.
• Ensure that acquisition activities follow approved procedures and account for the potential impact on affected systems.
• Coordinate evidence collection from live systems where necessary, recognizing that some collection methods may change system state.
• Record relevant limitations, collection failures, environmental conditions, and deviations from standard procedures.
• Maintain separation between evidence acquisition, analytical examination, and final investigative conclusions where appropriate.