Вакансии

Location: Москва Workplace: Гибридный О компании RED Security – открытая экосистема ИБ-решений и экспертизы для комплексной защиты бизнеса. RED Security SOC – центр мониторинга и реагирования на кибератаки. Обязанности расследовать нетиповые инциденты ИБ с различных источников; взаимодействовать с заказчиками по техническим вопросам; участвовать в выездном реагировании в инфраструктуре Заказчика; анализировать полноту и качество анализа инцидентов; принимать участие в разработке методик и инструкций (playbooks) по работе с инцидентами; обеспечивать развитие платформы по реагированию и инструментария для расследования инцидентов; проводить обучение и делиться опытом с другими аналитиками. Требования понимание векторов атак на корпоративные сети и способы противодействия; знание современных методов классификации тактик и техник атакующих (Mitre Attack, Kill Chain); опыт в расследовании инцидентов ИБ; умение анализировать журналы регистрации событий в различных системах (ОС, СЗИ, сетевое оборудование, прикладное ПО, access логи и др); экспертные знания в одном из доменов ИТ инфраструктуры (ОС, сеть, веб, виртуализация, БД). Условия собственную платформу MTS Ocean для получения ИТ-ресурсов, а это значит, что деплой, мониторинг, observability — не будут для тебя проблемой, ты сможешь сосредоточиться на фичах; профессиональные гильдии инженеров, где мы поддерживаем друг друга и помогаем стать лучше; внутреннюю площадку TechTalks для обмена опытом, дискуссий, развития навыков самопрезентации; участие во внешних IT конференциях. Наши эксперты выступают на ведущих профильных конференциях, таких как HighLoad++, DevOps Conf, Joker, AHA!, Матемаркетинг и другие. А еще мы организуем собственную масштабную конференцию True Tech Day и регулярно проводим митапы для разработчиков и инженеров; полезные курсы и вебинары в корпоративном университете и электронную библиотеку; ДМС с первого месяца работы, включая стоматологию; страхование от несчастных случаев с 1 месяца работы. Материальную помощь в сложных жизненных ситуациях; отпуск 28 календарных дней; прием врачей общей практики и массаж в офисе; мобильная связь за счет компании и льготные тарифы для близких; подписка на онлайн-кинотеатр KION, сервис МТС Музыка, книжный сервис Строки от МТС, безлимитные мессенджеры и соцсети; гибридный формат работы при наличии офиса, удаленный формат при отсутствии офиса.

Location: Israel About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a deeply technical DFIR Expert for its Digital Forensics and Incident Response (DFIR) team, working alongside the Security Operations Center (SOC). This role is a senior hands-on responder position, executing containment, eradication, and recovery on declared incidents and conducting the forensic investigations behind them, upholding the standards the DFIR team operates by. This role reports to the DFIR Lead, under the Detection and Response function within the CISO Office. Your responsibilities will include: Execute the technical response to major incidents from escalation through to recovery, in partnership with and under the direction of the DFIR Lead. Conduct end-to-end forensic investigations across cloud, platform, and endpoint environments. Handle evidence to a standard that meets legal, regulatory, and forensic requirements, including chain- of-custody discipline. Receive incident handoffs from the SOC and lead the response while the SOC continues to support the investigation. Produce post-incident deliverables: technical reports, root cause analyses (RCA), and regulatory-ready documentation. Contribute to DFIR runbooks, tooling selection and maturation, and readiness exercises (tabletops and simulations). Drive lessons-learned into measurable improvements in controls, detection fidelity, and response readiness together with the SOC, Security Engineering, and Threat Intelligence teams. Raise the wider team's forensic capability through case walkthroughs and mentoring of SOC analysts, and participate in the DFIR on-call rotation, acting as the response point of contact outside business hours. We expect you to have: Experience Around 5 years of hands-on digital forensics and incident response (DFIR) experience, including significant technical roles in large-scale, high-impact incidents (ransomware, advanced threat actors, cloud intrusions, identity compromise). Experience responding to incidents in cloud or infrastructure-heavy environments. Technical Expertise Deep knowledge of Windows and Linux internals, with proven disk and memory forensics capability. Cloud and container forensics: acquiring and analyzing evidence from cloud control planes, Kubernetes workloads, and identity systems. Fluency in attacker TTPs (MITRE ATT&CK), including the Cloud and Containers matrices. Hands-on experience with EDR, SIEM, and forensic tooling such as Velociraptor, Volatility, and X-Ways or EnCase. Strong scripting and data-analysis skills (Python, PowerShell, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions. Malware triage capability sufficient to characterize behavior, extract indicators, and inform containment decisions. Certifications such as GCFE, GCFA, GNFA, GCFR, or GREM are an advantage. Leadership & Communication Composed and decisive under incident pressure, with the ability to take clear response actions. Rigorous about evidence and intellectually honest: findings are validated and assumptions are labeled. Clear, concise communicator, able to brief technical peers and the DFIR Lead as readily as Legal, Privacy, and executive stakeholders. A genuine partner to the SOC, sharing context freely and respecting the investigation that came before the handoff. Fluent in English, written and verbal, comfortable working with international teams and stakeholders. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Israel About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. The role Nebius is seeking a deeply technical DFIR Lead to build and lead the company’s global incident response capability - its people, tooling, and methodology - while remaining the hands-on technical authority on the hardest investigations. Reporting to the SOC Manager, the DFIR Lead will recruit, grow and direct a team of DFIR Experts, owning response execution, chain of custody and quality across Nebius’ cloud, infrastructure, and platform environments. This is a hands-on role that balances deep technical work along with building and running the function: the Lead drives high-severity incidents end-to-end, serves as the escalation ceiling, and sets the standards and structure the team operates by. You’re welcome to work in our offices in Tel Aviv, Israel. Your responsibilities will include: Build and lead Nebius’ global DFIR capability - select and mature DFIR tooling, and establish the playbooks and follow-the-sun operating model across EMEA, Asia, and APAC while hiring and developing a team of responders. Lead the technical response to major incidents hands-on - from escalation through containment, eradication, and recovery - and act as the final technical authority on the most complex cases. Personally conduct end-to-end forensic investigations across cloud, platform, and endpoint environments - log analysis at scale, host and network forensics, memory analysis, malware triage, and timeline reconstruction. Define and enforce consistent investigation standards across the team: severity and escalation criteria, cross-region handoff quality, and evidence handling that meets legal, regulatory, and forensic requirements. Partner with the SOC, SOC Automation, Threat Intelligence, Threat Hunting, and Platform Security teams to improve detection fidelity and reduce MTTD and MTTR. Serve as the technical voice of incident response to executive leadership, Legal, and Privacy - delivering clear, risk-based briefings, regulatory-ready documentation, and root cause analyses (RCA). Raise the team’s technical bar through case reviews and hands-on mentoring, and drive lessons-learned into measurable improvements in controls and readiness. We expect you to have: Experience 7+ years of hands-on incident response and digital forensics, including technical leadership of large-scale, high-impact incidents (ransomware, nation-state / advanced threat actors, cloud intrusions, identity compromise). Experience building or leading IR teams and capabilities in cloud or infrastructure-heavy environments, which are highly regulated (SOC 2, ISO 27001, GDPR/NIS2). Technical Expertise Deep knowledge of Windows and Linux internals, with proven disk and memory forensics capability. Strong cloud-native platform security: containers and Kubernetes, CI/CD, secrets management, cloud control planes, and IAM attack paths. Fluency in attacker TTPs (MITRE ATT&CK, including the Cloud and Containers matrices), and hands-on experience with EDR, SIEM, and forensic tooling (e.g., Velociraptor, Volatility, X-Ways/EnCase). Strong scripting and data-analysis skills (Python, PowerShell, SQL/KQL) for investigation at scale, with the ability to validate findings independently and challenge assumptions. Leadership & Communication Proven ability to lead under pressure and make high-quality decisions with incomplete data; technical leadership through credibility across regions, without relying on direct authority. Clear, concise communicator capable of briefing executives, Legal, Privacy, and non-technical stakeholders. Working knowledge of spoken and written English Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Роль в Security Services: искать ручные процессы и автоматизировать их для SOC, DFIR, пентестеров и других подразделений. Инженер отвечает за весь цикл: от обсуждения процесса с внутренним заказчиком и создания прототипа до пилота, внедрения и передачи решения в эксплуатацию.

• Формирование и развитие программы проактивного выявления угроз и Threat Hunting в Компании, включая методологию, приоритизацию исследований, hunting backlog и критерии оценки результатов;

Location: Tel Aviv, Israel About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from data and model training through to production deployment, without the cost and complexity of building large in-house AI/ML infrastructure. Built by engineers, for engineers. From large-scale GPU orchestration to inference optimization, we own the hard problems across compute, storage, networking and applied AI. Listed on Nasdaq (NBIS) and headquartered in Amsterdam, we have a global footprint with R&D hubs across Europe, the UK, North America and Israel. Our team of 1,500+ includes hundreds of engineers with deep expertise across hardware, software and AI R&D. About the Role We are looking for a delivery-focused Security Operations Project Manager to join the Cyber Security PMO, reporting to the Head of PMO under the CISO. This is a dedicated, single-program role: you will own end-to-end delivery of the Global SOC Operation program one of the most strategically significant initiatives in the CISO organization. The program spans five major workstreams across SOC design, telemetry, detection, incident response, and continuous improvement. You will be the engine that keeps this program moving. What You Will Own You will be the single accountable PM for the Global SOC Operation program; responsible for driving execution, maintaining delivery momentum, and ensuring nothing falls through the cracks across a large, multi-workstream program. Execution and Delivery : own the end-to-end project lifecycle across all workstreams: from project initiation and planning through execution, validation, and formal closure. Ensure every workstream has a clear plan, named owners, realistic milestones, and a path to delivery. Planning and Tracking : build and maintain detailed project plans in Jira. Keep the program board accurate, up to date, and executive-ready at all times. Translate ambiguous objectives into structured, executable task hierarchies with clear ownership and sequencing. Dependency and Risk Management : identify and manage cross-workstream dependencies before they become blockers. Maintain a live RAID log, drive mitigations, and escalate critical risks with full context and a recommended course of action. Stakeholder Coordination : run structured governance across a wide range of stakeholders including SOC engineering, IT, Legal, Privacy, HR, Finance, and CISO leadership. Facilitate kickoffs, steering reviews, and milestone sign-offs. Navigate cross-functional friction, Privacy, Legal, Work Council; with persistence and structured escalation. Reporting and Visibility : produce concise, accurate status reporting for the Head of PMO and CISO. Surface progress, risks, decisions, and next steps in a format that enables fast, informed decision-making. What We Expect 4–6 years of hands-on project or program management experience with a strong delivery track record in complex, cross-functional technical environments. Proven ability to manage a large, multi-workstream program simultaneously. Deep Jira proficiency: task and epic management, board configuration, dashboards, reporting, and portfolio tracking. Strong project decomposition skills; able to take an ambiguous objective and break it into structured, executable workstreams with named owners and milestones. Proactive risk mindset: anticipates blockers, surfaces them early, and drives resolution without waiting to be directed. Strong written and verbal communication in both Hebrew and English, with confidence engaging global stakeholders. Technological orientation — able to understand SOC architecture, tooling stacks, and security workflows at a sufficient level to manage delivery and challenge estimates. Experience working within a SOC, CISO, or security operations environment; a must. Familiarity with SOC domains: SIEM, SOAR, detection engineering, threat hunting, DFIR, or incident management; a must. Nice to Have Knowledge of security frameworks such as NIST CSF, MITRE ATT&CK, or ISO 27001. Experience coordinating follow-the-sun or multi-region operational programs. Experience working with globally distributed teams in a high-growth technology or cloud infrastructure company. PMP, PRINCE2, or equivalent project management certification. What We Offer Ownership of one of the most strategically important programs in the Nebius security organization. Direct visibility to CISO leadership and real impact on how Nebius builds and operates its global SOC. A fast-moving, high-growth environment where you will build something from the ground up. A collaborative team with deep domain expertise across offensive security, SOC automation, CTI, and engineering. Benefits & Perks: Competitive compensation Career growth and learning opportunities Flexibility and ownership Collaborative and innovative culture Opportunity to work on impactful AI projects International environment and talented teams What's it like to work at Nebius: Fast moving - Bold thinking - Constant growth - Meaningful impact - Trust and real ownership - Opportunity to shape the future of AI Equal Opportunity Statement: Nebius is an equal opportunity employer. We are committed to fostering an inclusive and diverse workplace and to providing equal employment opportunities in all aspects of employment. We do not discriminate on the basis of race, color, religion, sex (including pregnancy), national origin, ancestry, age, disability, genetic information, marital status, veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable law. Applicants must be authorized to work in the country in which they apply and will be required to provide proof of employment eligibility as a condition of hire. If you need accommodations during the application process, please let us know.

Location: Madrid, Spain Workplace: hybrid Are you ready to join our digital revolution journey?    At Aleph, we’re not just part of the digital advertising landscape—we’re shaping its future. Representing the world’s leading platforms, including TikTok, Amazon, Google, and nearly 55 others, we operate in 130+ markets across new and existing geographies.   Our mission is to empower advertisers and brands to unlock the full potential of these platforms' advertising capabilities. By fostering long-lasting partnerships, we create limitless opportunities for people and businesses to advertise effectively at both local and global levels.   With a presence spanning continents, Aleph offers you the chance to be part of a fast-growing, innovative team where your work makes a direct impact. If you’re ambitious, forward-thinking, and eager to thrive in a dynamic, global environment, Aleph is the perfect place to build your career. We are looking for an experienced and operationally sharp Security Operations & Incident Response Analyst (L3) to join Aleph's global IT Security team. Reporting to the Global CISO, you will be the first line of defence when incidents occur and the engine behind the team's threat detection and response capabilities. You will own the end-to-end incident response process, lead threat hunting and intelligence activities, and manage the vulnerability and identity governance programmes — ensuring Aleph is both able to detect threats quickly and respond to them effectively across a complex, globally distributed environment. What you'll do: Incident Response Own and coordinate the end-to-end incident response process : identification, triage, containment, eradication, recovery, and post-incident review (lessons learned). Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources. Maintain and continuously improve incident response playbooks for the most relevant threat scenarios (ransomware, phishing, account compromise, data breach, insider threat, etc.). Manage the security incident log and register : track all incidents, document timelines and actions, and produce trend analysis and reporting for the CISO. Coordinate with external SOC or MDR providers where applicable: review daily reports, validate alert quality, and manage escalation workflows. Data Breach Management Lead data breach investigations : scope the breach, gather and preserve evidence, assess PII exposure, and coordinate response with Legal, Privacy, and HR. Produce breach investigation reports with findings, root cause, and recommendations. Threat Hunting & Intelligence Conduct proactive threat hunting across the environment: develop hypotheses based on threat intelligence, search for indicators of compromise (IoCs), and investigate anomalous behaviour. Manage the Threat Intelligence function : track relevant threat actors, TTPs (MITRE ATT&CK), and sector-specific threat campaigns; integrate intelligence into SIEM/XDR detection rules and hunting queries. Produce threat intelligence summaries and briefings for the CISO and relevant stakeholders. Vulnerability Management Own the vulnerability management programme : schedule and execute periodic vulnerability scans across infrastructure, endpoints, and cloud environments. Analyse scan results, prioritise findings by risk and exploitability, and coordinate remediation with IT Operations within agreed SLAs. Track remediation progress, produce vulnerability metrics, and report status to the CISO. Validate remediation effectiveness through re-scanning and spot-checks. Identity & Access Management (IAM) Manage periodic access reviews : coordinate with system owners and HR to review and certify user permissions across critical systems, ensuring least privilege is maintained. Oversee the Privileged Access Management (PAM) programme: define PAM policies, monitor privileged account usage, and review access rights for administrator-level accounts. Investigate and respond to identity-related anomalies and access policy violations. What we are looking for: 3–5 years in a SOC analyst, incident response, or security operations role, with at least 1–2 years at L3 level is a plus. Experience implementing or managing IAM and PAM solutions Experience working within international or multinational environments. Hands-on experience with incident response engagements (internal or consulting) is strongly valued. Relevant certifications: GCIH, GCFE, GCFA, CEH, CompTIA CySA+ , or equivalent. OSCP is a plus. Strong hands-on experience with SIEM platforms (alert triage, rule writing, query development) and EDR/XDR tools . Solid knowledge of the MITRE ATT&CK framework and its application to threat hunting and incident response. Experience conducting vulnerability scans using tools such as Tenable Nessus, Qualys, Rapid7, or similar. Familiarity with IAM and PAM concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM, or equivalent). Experience with digital forensics and incident response (DFIR) methodologies: evidence collection, log analysis, and timeline reconstruction. Knowledge of threat intelligence platforms and feeds (e.g. MISP, VirusTotal, threat intel feeds). Understanding of ISO 27001 incident management controls, NIS2 incident reporting obligations, and PCI DSS requirement 12.10 . Calm and decisive under pressure. Strong investigative mindset with structured problem-solving approach, excellent documentation skills. Ability to communicate incident status and findings clearly to both technical teams and executive stakeholders. Collaborative and proactive, comfortable working asynchronously across time zones. English : full professional proficiency (C1/C2) — primary working language. Spanish : professional proficiency is a plus. In line with the EU Pay Transparency Directive, we are committed to fair and open compensation practices. For this role, the minimum gross annual base salary is EUR 48,000 EUR. In addition to base salary, this role includes a variable component, paid annually. The final offer will reflect your experience, skills, and the scope of the role.   #Aleph Why Join Us?   Aleph is a place of many cultures, perspectives, and talents. We support each other, creating an environment of giving and receiving. We value partnership and communication because we believe it takes a group of people to achieve great things. We are energized by our ever-changing industry, our curiosity keeps us learning and seeking out new opportunities.     We stay flexible and adaptable, and believe in moving with the speed of change. We encourage everyone to strive for more, providing our internal talent with growth opportunities and the ability to learn together.    #ALEPH

What We Do: Huntress is a fully remote, global team focused on cybersecurity, founded in 2015 by former NSA cyber operators. They protect over 4 million endpoints and 7 million identities worldwide with enterprise-grade cybersecurity products designed alongside their Security Operations Center (SOC). What You’ll Do: - Triage, investigate, respond, and remediate various intrusions daily. - Review EDR telemetry, log sources, and forensic artifacts to determine root causes and provide remediation. - Perform tactical malware analysis. - Investigate suspicious Microsoft M365 activity and provide remediations. - Assist in escalations from Product Support for threat-related and SOC questions. - Contribute to detection engineering creation and tuning. - Participate in projects to improve outcomes for analysts and partners. - Collaborate in a mentored team environment. What You Bring To The Team: - 4+ years experience in SOC or Digital Forensics (DFIR). - Experience with Windows, Linux, and MacOS attack surfaces. - Knowledge of Threat Actor tools and techniques including MITRE ATT&CK Framework, PowerShell, Command Prompt, WMIC, Scheduled Tasks, SCM, Windows Domain and host enumeration, lateral movement, persistence, defense evasion, and other offensive TTPs. - Experience with static and dynamic malware analysis. - Working knowledge of Windows Administration or Enterprise Domain Administration including Active Directory, Group Policy, Domain Trusts. - Working knowledge of core networking concepts such as common ports/protocols, NAT, Public/Private IPs, VLANs. - Working knowledge of web technologies including web servers/applications and OWASP top 10. - Effective communication skills to explain complex events to less technical audiences. - Customer-focused decision making. - Strong curiosity and eagerness to learn. Preferred Qualifications: - Experience in MSP/MSSP/MDR roles. - Linux and MacOS investigative experience. - Experience with scripting languages like PowerShell, Python, Bash, PHP, JavaScript, or Ruby. - Experience with platforms like HackTheBox, TryHackMe, Blue Team Labs Online. - Experience with cloud investigations (M365, Azure, AWS, GCP). - Participation in cybersecurity competitions. - Familiarity with MSP tools such as RMMs. What We Offer: - 100% remote work environment. - Generous paid time off including vacation, sick time, and holidays. - 12 weeks paid parental leave. - Comprehensive medical, dental, and vision benefits. - 401(k) with 5% company contribution. - Life and disability insurance. - Stock options for full-time employees. - $500 one-time home office reimbursement. - Annual education and professional development allowance. - $75/month digital reimbursement. - Access to BetterUp coaching platform. Accommodations: - Reasonable accommodations available for application and selection process upon request. Huntress is committed to inclusivity and non-discrimination, except against hackers exploiting businesses.

Location: United States of America What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Director of Product Security and Incident Response Location: Remote US Compensation Range: $200,000.00 to $210,000.00 plus bonus and equity What You’ll Do: As a Staff CSIRT Analyst, you will be the cornerstone of Huntress’ internal security resilience. You will act as the primary internal escalation point from our SOC, ensuring we protect ourselves with the same rigor and products we use for our customers. In this role, you will strategize with leaders across multiple functions to identify work streams and own the end-to-end incident response lifecycle. You will guide teams, determine key milestones, and proactively anticipate blockers that could hinder our response capabilities. Responsibilities: Incident Response & Triage: Lead the identification, triage, and validation of security incidents through various telemetry sources, acting as the ultimate escalation point for the SOC. Strategic Preparedness: Drive organizational incident readiness by designing and executing practical response exercises (tabletops and purple teaming) to ensure first responders are prepared at all levels of our organization. Telemetry Optimization: Partner with engineering, product security, and detection engineering teams to tune existing telemetry sources to a high true-positive rate, reducing noise and increasing detection efficacy. Offensive Security Partnership: Collaborate closely with the Offensive Security team to identify visibility gaps and ensure proper coverage against modern threat actor TTPs. Partner with product security, engineering, detection engineering, and other applicable business units to close these gaps rather than treating them as a blocker. Continuous Improvement & Leadership : Lead cross-functional Post-Incident Reviews (PIRs) to extract critical lessons learned; own the lifecycle of resulting remediation tasks, driving specific tooling and process enhancements that harden organizational defenses and response against future threats. Stakeholder Communication: Develop and present comprehensive reports and "lessons learned" to stakeholders at all levels following major incidents or exercises. Documentation: Create and maintain playbooks, system configurations, and incident response standards to ensure scalability and supportability. What You Bring To The Team: Experience: 8+ years of experience in Incident Response, SOC Operations, or Digital Forensics (DFIR). Technical Expertise: Advanced knowledge of EDR/MDR platforms, log aggregation (SIEM/ELK), and cloud security environments (AWS/Azure/M365). Problem Solving: Proven ability to articulate the root cause of complex problems using first principles and translate insights into technical solutions. Strategic Thinking: Experience leading small project teams and aligning tech stacks across functions. Communication: Exceptional ability to convey complex technical incident details to both technical teams and executive leadership. Tooling: Familiarity with automation/SOAR platforms and documentation tools like Confluence, Jira, and Lucid Chart. Mindset: A proactive, forward-thinking approach to security with a passion for building "stewardship of culture" through inclusive and actionable security behaviors. What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Salt Lake City, Utah, United States About the Role iCapital is seeking a Cyber Case Manager to join the Global Information Security team within Cyber Security Operations. As the Security Operations Center (SOC) continues to grow, dedicated ownership of the case lifecycle has become essential to ensuring incidents and investigations are consistently tracked and driven to closure. The Cyber Case Manager serves as the single point of accountability for that lifecycle – from intake through resolution – ensuring every case is owned, prioritized, progressing, and documented. This individual-contributor will report to the Security Operations leader. Responsibilities Own the end-to-end lifecycle of security cases including intake, ownership assignment, progress tracking, and driving cases to resolution and closure. Serve as the single point of accountability for case status across the SOC, maintaining an accurate, prioritized, real-time view of all open incidents and investigations. Exercise authority to assign, reprioritize, and escalate cases across SOC Analysts, Threat Detection Engineering, and Incident Response to keep work moving and eliminate stalled cases. Enforce case-handling SLAs and quality standards; proactively identify aging, blocked, or at-risk cases and escalate to the Security Operations Leader. Coordinate cross-functional workstreams spanning incident response, DFIR, insider-threat cases, vulnerability-remediation tracking, audit and GRC findings, and eDiscovery and legal-hold requests. Manage case documentation and evidence integrity – ensuring timelines, actions, decisions, and artifacts are captured consistently and remain audit-ready. Integrate case workflows with SIEM/SOAR so alerts, enrichment, and automated actions flow into and out of the case record without manual re-keying. Produce case metrics and leadership reporting, including MTTD, MTTR, backlog, aging, closure rates, and SLA adherence for SOC leadership and stakeholders. Build and continuously improve case-management processes, intake criteria, and runbooks to increase throughput and reduce manager overhead. Facilitate case reviews, shift and regional handoffs, and post-incident lessons-learned, ensuring action items are tracked to completion. Leverage the SOC’s SIEM and SOAR platforms, with Jira and Confluence as the system of record. Collaborate with Legal, Compliance, Human Resources, SOC Analysts, Security Engineering, Cloud Security, Incident Response, and business stakeholders to support sensitive investigations, maintain confidentiality and chain of custody, and strengthen iCapital’s overall cyber resiliency. Participate in incident-driven after-hours coordination as needed to keep high-priority cases moving. Qualifications 3–6 years of experience in cyber security operations, incident response, or security case and program management Bachelor’s degree in information security, computer science, or information technology is preferred Experience in a regulated industry; financial services or fintech is preferred Hands-on experience managing incident or case queues in a SOC or incident response environment Working knowledge of SIEM and SOAR platforms and how alerts and cases flow through them Proficiency with Jira and Confluence for workflow management, tracking, and documentation Strong understanding of the incident response lifecycle and frameworks such as NIST and MITRE ATT&CK Demonstrated ability to coordinate across teams and drive work to closure through influence and follow-through, without direct reporting authority over those teams Familiar with handling sensitive investigations, evidence handling, and chain-of-custody principles Exceptional organization, prioritization, and attention to detail while managing many concurrent cases Excellent written and verbal communication skills, with the ability to report status clearly to both technical and executive audiences Relevant certifications (i.e. GCIH, GCFE, PMP, ITIL, or Splunk and SOAR) are preferred Experience with dedicated case-management or SOAR platforms (i.e. ServiceNow SIR, TheHive, Splunk SOAR and Phantom) Exposure to insider-threat, DFIR, eDiscovery, legal-hold, or GRC and audit workflows Familiar with cloud environments, AWS is preferred and knowledge of Agile frameworks is preferred Benefits The base salary range for this role is $100,000 to $130,000. iCapital offers a compensation package which includes salary, equity for all full-time employees, and an annual performance bonus. Employees also receive a comprehensive benefits package that includes an employer matched retirement plan, generously subsidized healthcare with 100% employer paid dental, vision, telemedicine, and virtual mental health counseling, parental leave, and unlimited paid time off (PTO). We believe the best ideas and innovation happen when we are together. Employees in this role will work in the office Monday-Thursday, with the flexibility to work remotely on Friday. For additional information on iCapital, please visit https://www.icapitalnetwork.com/about-us Twitter: @icapitalnetwork | LinkedIn: https://www.linkedin.com/company/icapital-network-inc | Awards Disclaimer: https://www.icapitalnetwork.com/about-us/recognition/ iCapital is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender, sexual orientation, gender identity, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

Location: United Kingdom What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, Security Operations Center Location: Remote UK Compensation Range: £62,000 to £70,500 base plus bonus and equity What You’ll Do: Huntress is looking for a Security Operations Center Analyst to add to our growing team. In this role, you will get to triage, investigate, respond, and remediate a variety of intrusions on a daily basis. You’ll be surrounded by passionate individuals who are mission-driven to help protect companies around the world from cyber-attacks and will have daily opportunities to progress your analyst skillset and accelerate your career growth. The Huntress Security Operations Center is an elite team of individuals who wake up every day to combat threat actors. You will have daily opportunities to progress your analysis skills while being at the forefront of what’s happening in the wild. If you’re looking to accelerate your career and skills, this is the team for you! Responsibilities: Triage, investigate, and respond to alerts from the Huntress platform Perform tactical review of EDR telemetry, log sources, and forensic artifacts to determine the root cause of attacks where possible and provide remediations needed to remove the threat Perform tactical malware analysis as part of investigating and triaging alerts Investigate suspicious Microsoft M365 activity and provide remediations Assist in escalations from the Product Support team for threat-related and SOC-relevant questions Contribute to detection engineering creation and tuning efforts Contribute to projects focused on driving better outcomes for our analysts and partners Contribute to our collaboratively mentored team (we're all here to make each other better!) What You Bring To The Team: 2+ years experience in a SOC or Digital Forensics (DFIR) role Demonstrated experience with Windows, Linux, and MacOS as an attack surface Demonstrated experience with basic Threat Actor tools and techniques: (MITRE ATT&CK Framework, PowerShell & Command Prompt Terminals, WMIC, Scheduled Tasks, SCM, Windows Domain and host Enumeration Techniques, Basic Lateral Movement Techniques, Basic Persistence Mechanisms, Basic Defense Evasion Techniques, other offensive/Red Team TTPs) Demonstrated experience with static and dynamic malware analysis concepts Working knowledge of Windows Administration or Enterprise Domain Administration Active Directory, Group Policy, Domain Trusts, etc. Working knowledge of core networking concepts Common ports/protocols, NAT, Public/Private IPs, VLANs, etc. Working knowledge of web technologies and concepts Web servers/applications, OWASP top 10, etc. Effective communication skills, with the ability to explain complex events to less technical audiences, enabling effective cross-functional collaboration within the SOC and across departments Dedicated to prioritizing and addressing customer needs and concerns in all decision-making processes A strong sense of curiosity and a genuine excitement for learning Preferred Qualifications: Previous experience in an MSP/MSSP/MDR role Linux and MacOS investigative experience Experience with scripting languages (such as PowerShell, Python, Bash, PHP, JavaScript, or Ruby) Demonstrated experience on platforms such as HackTheBox, TryHackMe, Blue Team Labs Online, etc. Demonstrated experience with Cloud-based investigations such as M365, Azure, AWS, GCP, etc. Participation in cybersecurity competitions such as Capture the Flags, the Collegiate Cyber Defense Competition, etc. Familiarity with MSP tools such as RMMs What We Offer: 100% remote work environment - since our founding in 2015 New starter home office set-up allowance (€480) Generous personal leave entitlements Digital monthly reimbursement (€111) Travel to the US 1-2 times/year for various company events Pension Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Ireland What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, Security Operations Center Location: Remote Ireland Compensation Range: €70,000 to €90,000 base plus bonus and equity What You’ll Do: Huntress is looking for a Security Operations Center Analyst to add to our growing team. In this role, you will get to triage, investigate, respond, and remediate a variety of intrusions on a daily basis. You’ll be surrounded by passionate individuals who are mission-driven to help protect companies around the world from cyber-attacks and will have daily opportunities to progress your analyst skillset and accelerate your career growth. The Huntress Security Operations Center is an elite team of individuals who wake up every day to combat threat actors. You will have daily opportunities to progress your analysis skills while being at the forefront of what’s happening in the wild. If you’re looking to accelerate your career and skills, this is the team for you! Responsibilities: Triage, investigate, and respond to alerts from the Huntress platform Perform tactical review of EDR telemetry, log sources, and forensic artifacts to determine the root cause of attacks where possible and provide remediations needed to remove the threat Perform tactical malware analysis as part of investigating and triaging alerts Investigate suspicious Microsoft M365 activity and provide remediations Assist in escalations from the Product Support team for threat-related and SOC-relevant questions Contribute to detection engineering creation and tuning efforts Contribute to projects focused on driving better outcomes for our analysts and partners Contribute to our collaboratively mentored team (we're all here to make each other better!) What You Bring To The Team: 2+ years experience in a SOC or Digital Forensics (DFIR) role Demonstrated experience with Windows, Linux, and MacOS as an attack surface Demonstrated experience with basic Threat Actor tools and techniques: (MITRE ATT&CK Framework, PowerShell & Command Prompt Terminals, WMIC, Scheduled Tasks, SCM, Windows Domain and host Enumeration Techniques, Basic Lateral Movement Techniques, Basic Persistence Mechanisms, Basic Defense Evasion Techniques, other offensive/Red Team TTPs) Demonstrated experience with static and dynamic malware analysis concepts Working knowledge of Windows Administration or Enterprise Domain Administration Active Directory, Group Policy, Domain Trusts, etc. Working knowledge of core networking concepts Common ports/protocols, NAT, Public/Private IPs, VLANs, etc. Working knowledge of web technologies and concepts Web servers/applications, OWASP top 10, etc. Effective communication skills, with the ability to explain complex events to less technical audiences, enabling effective cross-functional collaboration within the SOC and across departments Dedicated to prioritizing and addressing customer needs and concerns in all decision-making processes A strong sense of curiosity and a genuine excitement for learning Preferred Qualifications: Previous experience in an MSP/MSSP/MDR role Linux and MacOS investigative experience Experience with scripting languages (such as PowerShell, Python, Bash, PHP, JavaScript, or Ruby) Demonstrated experience on platforms such as HackTheBox, TryHackMe, Blue Team Labs Online, etc. Demonstrated experience with Cloud-based investigations such as M365, Azure, AWS, GCP, etc. Participation in cybersecurity competitions such as Capture the Flags, the Collegiate Cyber Defense Competition, etc. Familiarity with MSP tools such as RMMs What We Offer: 100% remote work environment - since our founding in 2015 New starter home office set up reimbursement (£398) Generous personal leave entitlements Digital monthly reimbursement (£92) Travel to the US 1-2 times/year for various company events Pension Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Remote US What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact. Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection. Huntress now secures more than 6M endpoints and 16M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other. Reports to: Manager, Security Operations Center Location: Remote, US (West Coast) Compensation Range: $100,000-$125,000 base plus bonus and equity. This role may be eligible for on-call/call-in pay in addition to base pay *The initial training period for this position will be Monday-Friday. Following training, the work schedule is subject to change and may include weekend or a 4x10 shift, depending on business requirements* What You’ll Do: Huntress is looking for a Security Operations Center Analyst to add to our growing team. In this role, you will get to triage, investigate, respond, and remediate a variety of intrusions on a daily basis. You’ll be surrounded by passionate individuals who are mission-driven to help protect companies around the world from cyberattacks and will have daily opportunities to progress your analyst skillset and accelerate your career growth. The Huntress Security Operations Center is an elite team of individuals who wake up every day to combat threat actors. You will have daily opportunities to progress your analysis skills while being at the forefront of what’s happening in the wild. If you’re looking to accelerate your career and skills, this is the team for you! Responsibilities: Triage, investigate, and respond to alerts coming in from the Huntress platform. Perform tactical review of EDR telemetry, log sources, and forensic artifacts to determine the root cause of attacks, where possible, and provide remediations needed to remove the threat. Perform tactical malware analysis as part of investigating and triaging alerts. Investigate suspicious Microsoft M365 activity and provide remediations. Assist in escalations from the Product Support team for threat-related and SOC-relevant questions. Contribute to detection engineering creation and tuning efforts. Contribute to projects focused on driving better outcomes for our analysts and partners Contribute to our collaboratively mentored team (we're all here to make each other better!). What You Bring To The Team: 4+ years of experience in a SOC or Digital Forensics (DFIR) role Demonstrated experience with Windows, Linux, and MacOS as an attack surface Demonstrated experience with basic Threat Actor tools and techniques: (MITRE ATT&CK Framework, PowerShell & Command Prompt Terminals, WMIC, Scheduled Tasks, SCM, Windows Domain and host Enumeration Techniques, Basic Lateral Movement Techniques, Basic Persistence Mechanisms, Basic Defense Evasion Techniques, other offensive/Red Team TTPs) Demonstrated experience with static and dynamic malware analysis concepts Working knowledge of Windows Administration or Enterprise Domain Administration Active Directory, Group Policy, Domain Trusts, etc. Working knowledge of core networking concepts Common ports/protocols, NAT, Public/Private IPs, VLANs, etc. Working knowledge of web technologies and concepts Web servers/applications, OWASP top 10, etc. Effective communication skills, with the ability to explain complex events to less technical audiences, enabling effective cross-functional collaboration within the SOC and across departments Dedicated to prioritizing and addressing customer needs and concerns in all decision-making processes A strong sense of curiosity and a genuine excitement for learning Preferred Qualifications: Previous experience in an MSP/MSSP/MDR role Linux and MacOS investigative experience Experience with scripting languages (such as PowerShell, Python, Bash, PHP, JavaScript, or Ruby) Demonstrated experience on platforms such as HackTheBox, TryHackMe, Blue Team Labs Online, etc. Demonstrated experience with Cloud-based investigations such as M365, Azure, AWS, GCP, etc. Participation in cybersecurity competitions such as Capture the Flags, the Collegiate Cyber Defense Competition, etc. Familiarity with MSP tools such as RMMs What We Offer: 100% remote work environment - since our founding in 2015 Generous paid time off policy, including vacation, sick time, and paid holidays 12 weeks of paid parental leave Highly competitive and comprehensive medical, dental, and vision benefits plans 401(k) with a 5% contribution regardless of employee contribution Life and Disability insurance plans Stock options for all full-time employees One-time $500 reimbursement for building/upgrading home office Annual allowance for education and professional development assistance $75 USD/month digital reimbursement Access to the BetterUp platform for coaching, personal, and professional growth Huntress is committed to creating a culture of inclusivity where every single member of our team is valued, has a voice, and is empowered to come to work every day just as they are. We do not discriminate based on race, ethnicity, color, ancestry, national origin, religion, sex, sexual orientation, gender identity, disability, veteran status, genetic information, marital status, or any other legally protected status. We do discriminate against hackers who try to exploit businesses of all sizes. Accommodations: If you require reasonable accommodation to complete this application, interview, or pre-employment testing or participate in the employee selection process, please direct your inquiries to accommodations@huntresslabs.com . Please note that non-accommodation requests to this inbox will not receive a response. Huntress uses artificial intelligence tools to assist in reviewing and evaluating job applications, including resume screening, skills assessment, and candidate matching and comparisons. These AI tools support our human recruiters in the initial review process, but do not make final hiring decisions without human involvement. By submitting your application, you acknowledge this use of AI in our recruitment process. Please review our Candidate Privacy Notice for more details on our practices and your data privacy rights. #BI-Remote

Location: Riyadh, Saudi Arabia; Doha, Qatar We’re on the hunt for a Cybersecurity Incident Response Specialist with the curiosity of a detective, the calm of a bomb disposal expert, and the analytical instincts of someone who enjoys untangling the world’s messiest PowerShell scripts. You’ll be joining the NetWitness Incident Response team in Saudi Arabia, working alongside a group of battle-tested DFIR professionals who thrive on turning chaos into clarity. You’ll investigate security incidents, perform digital forensics, analyze malware, and help organizations recover from the kind of problems that usually start with, "We just saw some unusual network traffic..." If you enjoy pulling threads to find out what really happened, and you’ve ever taken apart malware “just to see what makes it tick,” you’ll fit right in. Key Responsibilities Conduct cyber incident investigations and digital forensic analysis (sans drama, but with precision). Perform malware triage, memory forensics, and compromise assessments. Document findings clearly enough that even your non-technical colleagues will think you’re a wizard. Work with global NetWitness IR experts to respond to complex attacks and improve detection. Share knowledge, challenge hypotheses, and occasionally utter phrases like “It depends” with confidence. Requirements At least 5 years of solid, hands-on experience in cybersecurity. Minimum 2 years of direct involvement in incident response, digital forensics, or malware analysis. Alternatively, visible public research or open-source projects in DFIR or malware analysis are perfectly acceptable — we value results over titles. Strong technical foundation in Windows, Linux, and network investigations. Comfortable using tools like NetWitness, Volatility, Velociraptor, or your own custom scripts. Scripting skills in Python, PowerShell, or Bash – bonus points if you’ve written something that made your teammates both grateful and slightly afraid. SANS certifications (GCFA, GREM, GNFA, GCFE, etc.) are definite pluses, as is a calm demeanor during incidents that make others panic. Fluency in English; Arabic proficiency is a welcome advantage. Benefits Work with some of the brightest minds in digital forensics and incident response. Get hands-on with major cybersecurity incidents while using serious tooling (and a healthy dose of wit). Be part of a team that values curiosity, professional rigor, and the occasional well-timed sarcastic observation. Continual learning and growth opportunities through global collaboration and SANS-aligned training. If this sounds like your sort of challenge — and you’ve been known to say “I’ll just have a quick look at that memory dump” moments before losing three hours — we’d quite like to hear from you.