DFIR Lead | Dubai | AED 35,000-38,000 per month + Benefits

DFIR Lead | Dubai | AED 35,000-38,000 per month + Benefits

I’m working with an established cybersecurity services provider looking to appoint a Digital Forensics & Incident Response Lead in Dubai.

This is a hands-on leadership opportunity combining team management with complex forensic investigations, threat hunting and incident response engagements. You’ll lead the DFIR team and guide customers through major security incidents, including ransomware and advanced persistent threats.

Location: Dubai

Employment: Permanent

Salary: AED 35,000–38,000 per month

Relocation support: One month’s initial hotel accommodation

The role

• Lead, mentor and develop the DFIR team, overseeing daily activities and technical delivery.
• Lead incident response engagements from triage and containment through eradication and remediation.
• Conduct forensic investigations across endpoints, memory, disk images, network traffic and logs to establish root cause and attack scope.
• Analyse malware, identify indicators of compromise and develop detection content.
• Build scripts, tools and threat hunting queries to improve response capabilities.
• Develop incident response plans tailored to customer environments.
• Coordinate with technical teams, legal stakeholders and senior management during live incidents.
• Deliver clear customer reports covering findings and remediation recommendations.
• Support on-site customer engagements, including international travel when required.

What we’re looking for

• 10+ years’ information security experience, with substantial exposure to incident response, digital forensics, security operations or malware analysis.
• At least 2–3 years in a senior or lead capacity, mentoring analysts and guiding incident response engagements.
• Experience handling ransomware and APT investigations, using SANS or a comparable incident response methodology.
• Strong forensic investigation skills and experience analysing system, application and security logs.
• Malware analysis and reverse engineering experience, alongside detection rule development using YARA, Sigma or Snort.
• Strong understanding of attacker techniques, enterprise threat hunting, networking and TCP/IP.
• Scripting capability in Python, PowerShell or Bash.
• A relevant degree and at least one of: CISSP, GCIA, GCIH, GCFA, GCFE, GREM or OSCP.
• Confidence managing customer relationships and communicating technical findings to senior stakeholders.

Benefits

• Medical insurance for the employee.
• Annual flight tickets.
• One month’s initial hotel accommodation.
• Flexible/hybrid working arrangements.
• Learning, development and career progression opportunities.
• Employee wellness initiatives.