Lead Consultant - Incident Response (Cybersecurity)

TL;DR

Lead Consultant - Incident Response (OT Cybersecurity): Leading complex incident response engagements across OT and IT environments with an accent on industrial control systems, threat hunting, and forensic investigations. Focus on analyzing industrial protocols, implementing containment strategies in critical operational environments, and delivering executive technical briefings.

Location: Onsite in MBZ City, Abu Dhabi, United Arab Emirates

Company

hirify.global is a leading AI and computing conglomerate based in the United Arab Emirates, focusing on advanced technology solutions.

What you will do

• Act as the technical lead for IT and OT/ICS incident response engagements across energy, utilities, and manufacturing sectors.
• Conduct proactive threat hunting and forensic investigations on SCADA servers, HMIs, and engineering workstations.
• Analyze industrial network traffic and protocols (Modbus, DNP3, OPC-UA, etc.) to determine attack scope and root cause.
• Coordinate with operations and safety teams to implement containment and recovery actions without impacting critical physical processes.
• Develop and contribute to OT incident response playbooks, procedures, and security hardening guidance.
• Produce detailed technical reports and deliver executive briefings to stakeholders.

Requirements

• Must be based in or be able to work onsite in Abu Dhabi, UAE.
• Minimum 8 years of professional experience in incident response and OT cybersecurity.
• Deep knowledge of OT/ICS architectures and the Purdue Reference Model (Levels 0–4).
• Hands-on experience with industrial platforms including PLCs (Siemens, Allen-Bradley), DCS, and SCADA systems.
• GICSP (Global Industrial Cyber Security Professional) certification is a primary requirement.
• Proficiency in host-based forensics (Windows/Linux) and network analysis tools like Wireshark, Zeek, or Suricata.

Nice to have

• GIAC certifications such as GRID, GCIH, GCFE, GCFA, GNFA, or GCIA.
• CREST Registered Intrusion Analyst (CRIA) certification.
• Experience with OT security monitoring solutions such as Claroty, Dragos, Nozomi, or Tenable OT.
• Bachelor’s degree in computer science or engineering.