DFIR Lead: Incident Response & Digital Forensics

ZainTECH; Riyadh; Presencial; SAR 240.000 - 420.000; Jornada completa

Descripción de la vacante

ZainTECH is seeking a Digital Forensics & Incident Response Consultant to investigate cybersecurity incidents, conduct forensic examinations, and support containment, eradication, and recovery across customer environments.

You will provide specialist expertise in incident investigation, evidence preservation, compromise assessments, and advanced threat analysis, working with Microsoft 365, Entra ID, and SIEM tools to strengthen client defenses.

Formación

• Minimum 3 years hands‑on experience in digital forensics and incident response.
• Experience handling digital evidence with proper chain‑of‑custody.
• Knowledge of Microsoft 365 and Entra ID investigations.
• Familiarity with SIEM and security monitoring tools.
• Proficiency in Python or PowerShell scripting.

Responsabilidades

• Conduct digital forensic investigations across endpoints, servers, networks, and cloud environments.
• Acquire, preserve, and analyze digital evidence to determine scope and impact.
• Lead technical response for major incidents escalated by SOC Analysts.
• Perform malware analysis and triage to identify IOCs.
• Develop detection logic and contribute to SOAR playbooks and runbooks.
• Prepare comprehensive investigation reports for customers and stakeholders.

Conocimientos

Digital forensics

Incident response

Threat analysis

Python scripting

SIEM expertise

Microsoft 365

Evidence custody

Endpoint security

English fluency

Educación

Bachelor's in Cybersecurity

Herramientas

Velociraptor

KAPE

Volatility

EDR platforms

Descripción del empleo

ZainTECH is seeking a Digital Forensics & Incident Response Consultant to investigate cybersecurity incidents, conduct forensic examinations, and support containment, eradication, and recovery across customer environments.

You will provide specialist expertise in incident investigation, evidence preservation, compromise assessments, and advanced threat analysis, working with Microsoft 365, Entra ID, and SIEM tools to strengthen client defenses.