Regional DFIR Technical Lead — 24/7 Incident Expert

Group-IB; Riyadh; On-site; SAR 400,000 - 650,000; Full time

Benefits offered by this job

Funding for professionalCertifications

Global opportunities across Group-IB's

Career growth in DFIR leadership

Job summary

Group-IB seeks a seasoned Technical Lead for its DFIR team in the Riyadh region to act as the primary technical anchor during complex cybersecurity incidents. You will guide the team's technical direction, perform QA on investigations, and drive skill development under regional leadership.

This purely technical role excludes people management responsibilities, focusing on authority, deep forensic expertise, and cross‑domain coordination to anticipate threats and deliver clear, actionable

Qualifications

• 8+ years of DFIR experience in cybersecurity environments.
• Strong knowledge of DFIR methodologies, tools, and standards.
• Excellent stakeholder management and cross‑department collaboration.
• High‑level decision making in dynamic, high‑pressure settings.
• Experience in process design and optimization.

Responsibilities

• Provide continuous 24/7 DFIR service, including weekends and onsite client engagements.
• Lead technical direction during high‑stakes cybersecurity incidents as escalation point.
• Research and advise on new technologies and practices, including integration of LLMs.
• Mentor and grow DFIR team members and help communicate findings effectively.
• Maintain deep expertise in forensic fields and support QA of technical reports.
• Coordinate across cybersecurity domains and support project planning.

Skills

DFIR experience

DFIR methodologies

Stakeholder management

Decision making under pressure

Process management

Job description

Group-IB seeks a seasoned Technical Lead for its DFIR team in the Riyadh region to act as the primary technical anchor during complex cybersecurity incidents. You will guide the team's technical direction, perform QA on investigations, and drive skill development under regional leadership.

This purely technical role excludes people management responsibilities, focusing on authority, deep forensic expertise, and cross‑domain coordination to anticipate threats and deliver clear, actionable