Senior DFIR Guardian
On-siteRiyadh, Riyadh Region, Saudi Arabia
Job Summary
Conduct end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure, leading teams through triage to root cause analysis. Pull and analyze logs from EDR/XDR, SIEM, and email gateways to reconstruct attack timelines, while acquiring forensic images with full chain of custody. Go deep on artifacts like file systems and memory to correlate attacker behavior, then build AI-assisted workflows to automate evidence collection and scale capacity. Translate technical findings into clear narratives for executives and feed outcomes back into detection rules and policy improvements. Ensure all operations align with NCA ECC and SAMA CSF regulations.
Required Qualifications
- Bachelor's in Cybersecurity, International Relations, Computer Science, or related field
- 3+ years in digital forensics, incident response, or security investigations
- track record leading or coordinating DFIR engagements
- Exceptional written and verbal communication in both English & Arabic
- Hands-on proficiency with forensic tooling: FTK, X-Ways, Cellebrite, Axiom, or equivalent platforms
- Strong command of network protocols (TCP/IP, HTTP/S, DNS) and log analysis across SIEM platforms
- Scripting ability in Python, PowerShell, or Bash — used to automate evidence processing, not just theoretically
- Deep working knowledge of Windows, macOS, and Linux/Unix environments at the artifact and system level
- Proven experience integrating AI tools into investigative workflows to accelerate triage, pattern detection, or reporting
- Clear, confident communicator — able to brief executives and work alongside legal, HR, and compliance teams without losing technical precision
- Compliance: Ensuring all operations align with NCA ECC and SAMA CSF regulations
Desired Qualifications
- SANS / GIAC (GCFA, GCFE, GNFA, GCIA or similar)
- IACIS CFCE
- EC-Council CHFI
- Offsec (OSDA, OSIR)
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.