Regional Head of DFIR

Founded in 2003 and headquartered in Singapore, Group-IB is a leading creator of cybersecurity technologies to investigate, prevent, and fight digital crime. Combating cybercrime is in the company’s DNA, shaping its technological capabilities to defend businesses, and citizens, and support law enforcement operations.

Group-IB’s Digital Crime Resistance Centers (DCRCs) are located in the Middle East, Europe, Central Asia, and Asia-Pacific to help critically analyze and promptly mitigate regional and country-specific threats. These mission-critical units help Group-IB strengthen its contribution to global cybercrime prevention and continually expand its threat-hunting capabilities.

Each of us can help make the world a safer place. Join us!

The META Head of DFIR Practice will lead the development and execution of Digital Forensics and Incident Response (DFIR) initiatives.

This role involves overseeing incident response cases, managing a growing team, and ensuring efficient operations aligned with both regional and global standards. The position offers significant independence in defining key metrics, operational processes, and methodologies while working in close collaboration with other business units including SOC, Threat Intelligence, Investigations, Red Teaming, and EDR Development.

Strategic & Operational Leadership

• Design and implement DFIR workflows, engagement strategies, and best practices specific to the META market.
• Establish and refine rules of engagement, ensuring consistency across global DFIR teams.
• Define and monitor key performance indicators (KPI) including incident response retainer (IRR), case volume, and billable hours with the flexibility to introduce additional relevant metrics.
• Oversee the handling of major incident response cases and resource allocation.
• Build and manage a high-performing DFIR team in the META region, ensuring team members have clear roles and responsibilities.
• Develop and sustain a knowledge-sharing culture, encouraging collaboration and professional growth.
• Lead the hiring process for new DFIR team members, defining role requirements, participating in candidate selection, and ensuring smooth onboarding.

• Strengthen relationships with internal teams including SOC, Threat Intelligence, Investigations, and Red Teaming.
• Promote joint research, consulting initiatives, and knowledge-sharing efforts.
• Drive thought leadership through public research and contributions to the industry.

• Take initiative in shaping the strategic direction of DFIR operations and contribute to regional coordination efforts.
• Work closely with the Director of Services, Sales, and Pre-Sales teams to ensure alignment of business goals and service offerings.

• Develop the DFIR budget for tools, training, certifications, and travel, subject to negotiation with the Global Head of DFIR Practice and CRO.
• Identify and implement appropriate DFIR tools while aligning with global technology choices where possible.
• Support continuous professional development of team members through certifications and training opportunities

• Extensive experience in DFIR including leadership roles in cybersecurity organizations.
• Proven ability to scale teams, optimize operations, and deliver exceptional incident response services.
• Strong knowledge of DFIR methodologies, tools, and industry standards.
• Experience in budget planning and effective resource allocation.
• Ability to define, track, and drive performance metrics.
• Strong stakeholder management and interdepartmental collaboration skills.
• High-level decision-making skills in dynamic and high-pressure environments.
• Proficiency in process management including process design and optimization.
• Experience in public speaking and publication of DFIR-related findings is an advantage.
• Experience in intelligence tradecraft across cyber and other domains is highly desirable
• A proven track record in academic research is preferred.

• Growth in DFIR team size and case volume.
• Achievement of revenue and margin targets.
• Consistently…