Lead Consultant - FortiGuard Incident Response

Fortinet, Inc.; Saudi Arabia; On-site; SAR 150,000 - 300,000; Full time

Job summary

Fortinet, Inc. is seeking a Lead Consultant – FortiGuard Incident Response to lead incident response engagements and mentor a team of security consultants. You will act as the primary client contact, deliver technical and executive updates, and drive process improvements across services.

You will perform host-based forensics, memory analysis, and threat research while leveraging FortiEDR tooling. Flexibility for after-hours engagements is required.

Qualifications

• Bachelor’s degree in Computer Engineering or Computer Science or related field, or 10+ years IR/Forensics experience.
• Strong consulting skills and ability to mentor junior analysts.
• Experience with incident response tooling and malware analysis workflows.

Responsibilities

• Lead IR engagements and mentor junior analysts.
• Serve as primary client contact during investigations with clear updates.
• Focus on process improvement for customer-facing IR services.
• Conduct host-based analysis on Windows, Linux, and Mac OS X.
• Review logs to identify malicious activity and use FortiEDR for investigations.
• Perform memory forensics and file analysis as needed.
• Create threat research blogs and presentations for audiences.
• Availability for nights/weekends as needed.

Skills

Excellent communication

Customer interaction

Scripting languages

YARA / RegEx data mining

Malware analysis tools

Operating system internals

Executive communication

Education

Bachelor's in Computer Engineering/CS

10+ years IR/Forensics

Tools

EnCase

FTK

X-Ways

SIFT

Splunk

Volatility

Wireshark

TCPDump

IDA Pro

OllyDbg

Immunity Debugger

Job description

Lead Consultant - FortiGuard Incident Response

Job Info

• Job Identification 22450
• Job Category Incident Response
• Posting Date 10/01/2026, 09:12 AM
• Job Schedule Full time

Job Description

We are looking for a Lead Consultant – FortiGuard Incident Response to work in a dynamic and exciting new position reporting to the Director of Operations for FortiGuard Security Consulting Services. The analyst will work directly with members of a world class incident response and forensics team. Our team is comprised of individuals with strong knowledge in malware hunting and analysis, reverse engineering, multiple scripting languages, forensics and threat actors’ TTPs . In this very hands‑on customer facing role the consultant’s main objective is to lead and manage the incident response engagements and train/mentor other security consultants. Leveraging your in‑depth understanding of the threat actors’ tactics, techniques, procedures and tools as well as our flagship FortiEDR tooling you will need to quickly glean situational awareness to provide guidance to the team members as well as to the client. In addition, from time to time the candidate will help to create threat research work products such as blogs and presentations. To be successful in this role the candidate must be possess strong consulting skills, deep technical skills and able to work under tight timelines.

Responsibilities:

• Lead IR engagements and mentoring/training junior analysts
• Serve as the primary contact for clients during investigations, delivering clear technical and executive‑level updates.

Continue to focus on process improvement for the customer facing incident response services

Conduct host‑based analysis and forensic functions on Windows, Linux, and Mac OS X systems

Review firewall, web, database, and other log sources to identify evidence and artifacts of malicious and compromised activity

Leverage our FortiEDR Platform to conduct investigations to rapidly detect and analyze security threats

• Perform memory forensics and file analysis as needed

Contribute to threat intelligence consumption and generation within the FortiGuard threat intelligence ecosystem.

Perform basic reverse engineering of threat actors’ malicious tools

Develop complete and informative reports and presentations for both executive and technical audience

Availability during nights/weekends as needed for IR engagements

Required Skills:

• Excellent written and verbal communication skills

Experience interfacing with customers

• Experience with of at least one scripting language: Shell, Ruby, Perl, Python, etc
• Ability to data mine using YARA, RegEx or other techniques to identify new threats

Experienced with EnCase, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, WireShark, TCPDump, and open source forensic tools a plus

• Experience with malware analysis tools such as IDA Pro, OllyDbg, Immunity Debugger
• Hands‑on experience dealing with APT campaigns, attack Tactics, Techniques and Procedures (TTPs), memory injection techniques, static and dynamic malware analysis and malware persistence mechanism
• Strong knowledge of operating system internals and endpoint security experience.
• Able to communicate with both technical and executive personnel
• Static and dynamics malware and log analysis
• Analysis of Linux and MAC binary files and the understanding of MAC internals is a plus but not required .
• Highly motivated, self‑driven and able to work both independently and within a team
• Able to work under pressure in time critical situations and occasional nights and weekends work

A solid understanding of Active Directory and how to secure is a plus

Education:

• Bachelor’s Degree in Computer Engineering, Computer Science or related field
• Or 10+ years’ experience with incident response and or Forensics

About Us

Fortinet makes possible a digital world that we can always trust through its mission to protect people, devices, and data everywhere. This is why the world’s largest enterprises, service providers, and government organizations choose Fortinet to securely accelerate their digital journey. The Fortinet Security Fabric platform delivers broad, integrated, and automated protections across the entire digital attack surface, securing critical devices, data, applications, and connections from the data center to the cloud to the home office. Ranking #1 in the most security appliances shipped worldwide, more than 615,000 customers trust Fortinet to protect their businesses. And the Fortinet NSE Training Institute, an initiative of Fortinet’s Training Advancement Agenda (TAA), provides one of the largest and broadest training programs in the industry to make cyber training and new career opportunities available to everyone.