Work where the incidents are real and the team is senior.

Aureon hires experienced practitioners who want to do serious work with peers who respect it: incident responders, forensic analysts, platform engineers, intelligence analysts and advisers. We are remote-first across Europe, the Middle East and Africa, with our registered office in Dubai.

Open roles Open application

Senior by design

Every engagement is led by an experienced practitioner. Juniors are mentored, not used as a shield.

Remote-first

Work from where you live. We meet in person for engagements that need it and for team gatherings.

Real responsibility

You own your cases and your platforms, and you sign your reports.

Learning funded

Certifications, conferences and lab time are part of the job, not a favour.

Open roles

Positions we are hiring for now.

All roles are remote-first within EMEA time zones. Applications go to jobs@aureonintelgroup.com with the role title in the subject line.

Incident Response

Senior Digital Forensics & Incident Response Consultant

Fully remote (EMEA time zones) Full-time 5+ years in hands-on DFIR
Apply

Lead incident response engagements for enterprises, insurers and counsel across Europe, the Middle East and Africa. You will run containment, investigation and recovery on ransomware, business email compromise, cloud account takeover and insider cases, and you will write the reports that boards, claims handlers and courts rely on.

What you will do

  • Act as response lead on active incidents: scoping, containment strategy, evidence preservation, stakeholder communication and recovery coordination.
  • Perform forensic acquisition and analysis of endpoints, servers, hypervisors, mobile devices and cloud tenants (Microsoft 365, Entra ID, Google Workspace, AWS, Azure).
  • Reconstruct attack timelines across endpoint, identity, email, network and cloud telemetry and identify initial access, lateral movement, persistence and exfiltration.
  • Produce executive and technical reports for insurers, brokers, breach counsel and regulators, and support expert testimony where required.
  • Contribute detection content, indicators and lessons learned to our managed detection and threat intelligence teams.
  • Participate in the on-call rotation for the 24/7 incident desk and mentor analysts.

What we are looking for

  • At least 5 years of hands-on incident response and digital forensics, including responsibility for complete engagements.
  • Deep experience with at least one EDR platform (CrowdStrike Falcon or comparable) and with forensic tooling such as Velociraptor, KAPE, Plaso, Volatility and commercial suites.
  • Strong understanding of Windows and Active Directory internals, Linux, virtualisation and cloud identity.
  • Proven ability to write clear, defensible reports in English for non-technical and legal audiences.
  • Fluent English. Spanish, French or Arabic are valued.
  • Certifications such as GCFA, GCFE, GCIH, GREM or GNFA are valued; experience matters more.
  • Right to work in the country of residence and availability for occasional travel within EMEA.

What we offer

  • Fully remote work with flexible hours, balanced by on-call duties that are planned and compensated.
  • Senior-only team: you work with peers, not as a layer below partners who never touch evidence.
  • Budget for training, certifications and conferences.
  • Direct exposure to insurers, counsel and regulators across EMEA.
Reference: SENIOR-DFIR-CONSULTANTApply for this role
Managed Services

Security Platform Engineer (EDR, SASE and Backup)

Fully remote (EMEA time zones) Full-time 3+ years operating enterprise security platforms
Apply

Own the platforms that our clients and our own operations depend on: endpoint detection, secure access and backup. You will design, deploy, harden and operate these technologies across multiple client environments, and you will be the person responders call when they need a sensor deployed or a backup restored at three in the morning.

What you will do

  • Deploy, configure and operate CrowdStrike Falcon across endpoint, identity and cloud modules, including policies, exclusions, sensor health and integrations.
  • Design and manage Netskope deployments: SASE and zero-trust access, CASB, DLP and web policies for distributed workforces.
  • Operate and harden Veeam Backup & Replication environments with immutable repositories, tested restoration and recovery sequencing for ransomware scenarios.
  • Administer Microsoft 365 and Entra ID security configuration, conditional access and logging, and virtualisation platforms such as VMware and Proxmox.
  • Automate deployment and monitoring with scripting and APIs, document runbooks and maintain configuration baselines.
  • Support incident response engagements with rapid tooling deployment and recovery operations.

What we are looking for

  • At least 3 years operating enterprise security or infrastructure platforms in production, ideally for multiple organisations.
  • Hands-on experience with CrowdStrike Falcon and Netskope, or equivalent EDR and SASE platforms, and with Veeam or comparable enterprise backup solutions.
  • Solid Windows, Linux, networking and Microsoft 365 administration skills.
  • Scripting ability in PowerShell, Python or Bash and comfort with REST APIs.
  • Structured, documentation-minded way of working and a security-first mindset.
  • Fluent English. Spanish is valued.
  • Vendor certifications (CrowdStrike, Netskope, Veeam, Microsoft) are valued.

What we offer

  • Fully remote work with flexible hours and planned, compensated on-call.
  • Modern stack and real responsibility for platforms that protect critical organisations.
  • Budget for vendor certifications and training.
  • A small senior team where engineering decisions are yours to make and defend.
Reference: SECURITY-PLATFORM-ENGINEERApply for this role
How we hire

Four steps, no theatre.

1

Apply

Send your CV and a short note on the work you are most proud of to jobs@aureonintelgroup.com, with the role in the subject line.

2

Conversation

A 45-minute call with a senior member of the team about your experience and ours.

3

Practical exercise

A realistic, time-boxed exercise related to the role, reviewed together.

4

Offer

Final conversation on scope, conditions and start date. We move quickly.

We process application data in accordance with our Privacy Policy. Unsuccessful applications are deleted within 12 months unless you ask us to keep them for future roles.

Do not see your role?

We are always interested in experienced incident responders, forensic analysts, offensive security specialists, intelligence analysts and regulatory advisers.

Send an open application