Lead Incident Response Consultant - FortiEDR & Forensics

Fortinet, Inc.; Saudi Arabia; On-site; SAR 150,000 - 300,000; Full time

Job summary

Fortinet, Inc. is seeking a Lead Consultant – FortiGuard Incident Response to lead incident response engagements and mentor a team of security consultants. You will act as the primary client contact, deliver technical and executive updates, and drive process improvements across services.

You will perform host-based forensics, memory analysis, and threat research while leveraging FortiEDR tooling. Flexibility for after-hours engagements is required.

Qualifications

• Bachelor’s degree in Computer Engineering or Computer Science or related field, or 10+ years IR/Forensics experience.
• Strong consulting skills and ability to mentor junior analysts.
• Experience with incident response tooling and malware analysis workflows.

Responsibilities

• Lead IR engagements and mentor junior analysts.
• Serve as primary client contact during investigations with clear updates.
• Focus on process improvement for customer-facing IR services.
• Conduct host-based analysis on Windows, Linux, and Mac OS X.
• Review logs to identify malicious activity and use FortiEDR for investigations.
• Perform memory forensics and file analysis as needed.
• Create threat research blogs and presentations for audiences.
• Availability for nights/weekends as needed.

Skills

Excellent communication

Customer interaction

Scripting languages

YARA / RegEx data mining

Malware analysis tools

Operating system internals

Executive communication

Education

Bachelor's in Computer Engineering/CS

10+ years IR/Forensics

Tools

EnCase

FTK

X-Ways

SIFT

Splunk

Volatility

Wireshark

TCPDump

IDA Pro

OllyDbg

Immunity Debugger

Job description

Fortinet, Inc. is seeking a Lead Consultant – FortiGuard Incident Response to lead incident response engagements and mentor a team of security consultants. You will act as the primary client contact, deliver technical and executive updates, and drive process improvements across services.

You will perform host-based forensics, memory analysis, and threat research while leveraging FortiEDR tooling. Flexibility for after-hours engagements is required.