Digital Forensics and Incident Response Consultant (UAE)

The Role

This freelance bench role involves acquiring forensic evidence across endpoints, servers, memory, network and cloud environments during live incidents. The consultant triages compromises, builds timelines from artefacts, investigates Microsoft 365 and cloud intrusions, scopes data exfiltration, and writes evidential reports for clients, insurers, lawyers and regulators.

Skills & Experience

Requires at least five years in cyber security, three hands-on in DFIR, with proficiency in tools such as Velociraptor, KAPE, X-Ways, Magnet Axiom, EnCase, FTK or Volatility, plus SIEM and KQL skills. Certifications like GCFA, GCFE, GNFA, GREM or GCIH are valued, alongside scripting and strong report-writing ability.

Who It Suits

Suited to experienced DFIR practitioners who want flexible, engagement-based work rather than a permanent or on-call position, and who are comfortable handling ransomware, BEC and insider cases independently alongside an incident manager.