Senior DFIR Lead: Incident Response & Digital Forensics

cloud consultancy - ccds; As Sudiyah; On-site; OMR 31,000 - 43,000; Full time

Job summary

cloud consultancy - ccds in Riyadh, Saudi Arabia, seeks an experienced cybersecurity Incident Response Lead for a 13-month project-based engagement. You will direct investigations, preserve evidence, and report to executives with a focus on regulatory compliance.

The role requires 7+ years in IR and DFIR, strong knowledge of NIST/MITRE ATT&CK, and hands-on use of SIEM/EDR tools, EnCase, FTK, Volatility, and Autopsy. Saudi nationality is mandatory.

Qualifications

• Saudi nationality is required.
• Bachelor's degree in Cybersecurity, Digital Forensics, Computer Science, or related field.
• 7+ years of experience in cyber incident response and digital forensics.
• Strong knowledge of attacker behavior, incident investigation methods, NIST, and MITRE ATT&CK.
• Hands-on experience with forensic tools: SIEM, EDR, EnCase, FTK, Volatility, Autopsy.
• Understanding of digital evidence handling and chain of custody.

Responsibilities

• Investigate cybersecurity incidents and determine scope, impact, entry vectors, and affected assets.
• Contain, eradicate, recover, perform root-cause analysis, and conduct post-incident reviews.
• Collect, preserve, and analyze digital evidence with proper chain-of-custody.
• Conduct disk, memory, network, endpoint, and malware analysis using forensic tools.
• Develop and maintain incident-response procedures, playbooks, and evidence-handling guides.
• Prepare technical and executive incident reports, forensic findings, and RCA reports.
• Coordinate with internal teams and stakeholders to ensure NCA-compliant classification and reporting.

Skills

Incident response

Digital forensics

Technical writing

Regulatory reporting

Education

Bachelor's degree in Cybersecurity or related field

Tools

SIEM

EDR

EnCase

FTK

Volatility

Autopsy

Job description

cloud consultancy - ccds in Riyadh, Saudi Arabia, seeks an experienced cybersecurity Incident Response Lead for a 13-month project-based engagement. You will direct investigations, preserve evidence, and report to executives with a focus on regulatory compliance.

The role requires 7+ years in IR and DFIR, strong knowledge of NIST/MITRE ATT&CK, and hands-on use of SIEM/EDR tools, EnCase, FTK, Volatility, and Autopsy. Saudi nationality is mandatory.