Digital Forensics and Incident Response Consultant (UAE)

Outbreach is building the bench of DFIR practitioners who do the forensic work inside a live incident, from evidence acquisition through to the report the client, their insurer and their lawyers rely on.
You would be the person who acquires the evidence, works out what actually happened, and writes the account of it that the client, their insurer, their lawyers and sometimes a regulator will rely on. Our incidents are mid market and fast moving: ransomware, business email compromise, data theft and insider cases. You would work alongside an Incident Manager who owns the client relationship, so your time goes on the technical investigation rather than on running the crisis.
Key Responsibilities
Acquire evidence properly and defensibly across endpoints, servers, memory, network and cloud, with chain of custody that stands up later.
Triage at speed under pressure, and separate what is known, what is suspected and what is not yet established.
Build the incident timeline from the artefacts, using host and endpoint forensics, Windows and Linux internals and log analysis across the estate.
Investigate Microsoft 365 and Entra ID compromise, including the unified audit log, token and conditional access abuse and mailbox rules.
Investigate cloud intrusions in AWS, Azure or Google Cloud using the provider's own logging.
Scope data exfiltration and establish what was actually taken, which is the question that drives the client's notification obligations.
Triage malware found in the environment and call in deeper reverse engineering where it is warranted.
Determine root cause and initial access, set out the containment and eradication actions for the client's team, and verify they worked.
Write forensic reports and statements to an evidential standard, and be prepared to explain your findings to an insurer, a regulator or a court.
Feed findings to the Incident Manager, legal counsel and communications as the picture develops, in language each of them can use.
Skills and Experience
Minimum 5 years cyber security experience is required for this role, with at least 3 of them doing hands on digital forensics and incident response on real incidents.
Evidence acquisition and analysis in practice: disk and memory imaging, triage collection at scale, and the discipline that keeps evidence admissible.
Two or more of Velociraptor, KAPE, X-Ways, Magnet Axiom, EnCase, FTK, Volatility or the Zimmerman tools, plus a SIEM such as Splunk or Microsoft Sentinel and query languages including KQL.
Cloud and identity forensics across Microsoft 365, Entra ID and at least one of AWS, Azure or Google Cloud.
Ransomware casework, including encryption scoping, persistence hunting, exfiltration assessment and the realities of recovery.
Scripting in Python or PowerShell to make the work repeatable.
Writing. Our reports are read by non technical people who make expensive decisions on them.
Certifications such as GCFA, GCFE, GNFA, GREM or GCIH, or equivalent proof of the same ability.
Right to work in the UAE.
Highly desirable but not vital
Experience as an expert witness, or casework that reached litigation or a regulator.
Reverse engineering or malware analysis depth.
Experience from a consultancy, a DFIR firm or a regulated in house CSIRT.
Operational technology or cloud native incident experience.
Security clearance.
Commitment
This is a bench role. You are called when an incident matches your skills and experience, there is no expectation that you sit on call, and you can decline work. Rates are hourly, agreed before an engagement starts, and equivalent to over AED 550,000 a year on a full time basis.

Work arrangement
Yes