Cyber Incident Responder

Outbreach is a specialist cyber incident response and crisis management firm working with mid market organisations in the UK and the Gulf. We bring together incident management, digital forensics, legal, crisis communications and recovery under one roof so that a client in the middle of a breach has one partner rather than five. We are recruiting on call bench Incident Responders based in the UAE who can be called on to supplement our permanent team when clients experience an incident.
The Incident Responder (IR) is the main person responsible for the technical operational tasks necessary to provide our clients with a high quality, rapid and comprehensive response to a breach. They will be at the forefront of all incidents and absolutely critical to the successful resolution. They will be intimately familiar with a wide variety of attacks, from ransomware to BEC, insider threat and DDoS, to name just a few examples.
The IR will be expected to work closely with Incident Managers and feed information to and from specialists in other areas of the incident response such as forensic, legal or PR. The IR will be able to handle pressure, multiple conflicting demands, and possibly chaotic environments with limited knowledge of the company or crisis. They will be expected to help bring order to the incident and contribute to the swift attainment of the client's objectives.
Key Responsibilities
First and foremost, this role is responsible for leading the restoration of our client's IT systems after a cyber attack.
Working with the Incident Manager to help triage an initial call.
Assess the state of the IT systems, report on the damage incurred and any other exposure.
Implement temporary infrastructure to sustain key business operations during the incident.
Collect and analyse intrusion artefacts such as logs, source code and malware.
Conduct a root cause analysis to determine how the attack happened, any lateral movement or infection.
Fully clean and remove any residual infection, malware or other damage caused by the attacker.
Ensure that vulnerabilities are remediated to prevent future reinfection by the same or similar method.
Collaborate with Forensic, Legal, PR, Comms and third parties to ensure a comprehensive response.
Monitor external sources to determine threats, evidence of breaches and breach impact.
Document response activities, findings and recommendations.
Outside of live incidents
Engage with proactive audit and investigations to plan for a breach.
Conduct threat hunting and other pre breach or breach confirmation operations.
Help to refine and improve playbooks, runbooks and overall response methodology.
Skills and Experience
Cyber security experience is required for this role, including 3+ years as a cyber incident responder.
5+ years in a technical support or engineering role, or demonstrable advanced technology knowledge.
Strong knowledge of operational security across multiple platforms and all major cloud providers.
Certifications such as GCIH, GCIA or GCFA/GCFE.
Real enthusiasm for cyber security demonstrated by research, testing or other activities.
Advanced knowledge of the MITRE ATT&CK framework and common TTPs.
Extensive experience with Business Continuity and Disaster Recovery.
Incredibly methodical and attentive to the smallest of details.
Strong communication skills and presentable to clients and senior executives.
Highly Desirable but not Vital
Experience gained from a consultancy or highly regulated organisation.
Experience working in a 24/7 operation.
Previous experience as a SOC analyst or Red Team.
Risk and compliance practices.
Familiarity with the UAE PDPL, DIFC and ADGM regimes.
Arabic language skills.
Commitment
As a bench Incident Responder you will be called whenever a suitable incident is raised by our clients which matches your skill and experience level. There is no expectation for you to remain on call or to accept any incident when you are not available. However, once you commit to an incident you will become a key member of the response team and will be expected to remain engaged for the duration of the incident. At the least this would be for one day, but in most cases will likely be for two to four weeks.
Full training and support will be provided to successful candidates, who will be expected to attend regular paid meetings to ensure they are familiar with the company, its methodologies and market.
Pay and Benefits
Remote working with much of your work being done where you please.
Flexible hours that can be scaled up or down as suits you.
Working in an expanding cyber security business where you can grow in your career and help shape the business.
Training and development budget aligned to formal relevant qualifications.
Hourly pay equivalent to over AED 550,000 a year, with a significant increase for unsociable hours if needed.
Eligible for company stock options, subject to minimum hours.
Location: United Arab Emirates, remote. Engagement: On call bench role, hourly paid. Full details and the application form are also at outbreach.com/career/incident-responder-uae/

Work arrangement
Yes