Senior Cyber Incident Response & Digital Forensics Lead

CCDS; Riyadh; On-site; SAR 300,000 - 520,000; Part time

Job summary

CCDS is seeking an experienced Cybersecurity Incident Responder with 7+ years in DFIR to lead investigations in Riyadh on a project-based engagement (13 months). The role focuses on incident containment, evidence handling, and regulatory reporting per NCA requirements.

You will work on forensic analysis across disk, memory, network and endpoints, develop playbooks, and communicate findings to executives and technical teams. On-site in Riyadh is required.

Qualifications

• Bachelor’s degree in cybersecurity, forensics, CS or related field.
• 7+ years in cyber incident response and digital forensics.
• Strong knowledge of NIST, MITRE ATT&CK and attacker behaviors.

Responsibilities

• Lead cybersecurity incidents and determine attack scope, impact, and entry vectors.
• Perform containment, eradication, recovery, root-cause analysis, and post-incident review activities.
• Collect, preserve, and analyze digital evidence with chain-of-custody.
• Conduct disk, memory, network, endpoint, and malware analysis with forensic tools.
• Develop incident-response procedures, playbooks, and evidence-handling guides.
• Prepare technical and executive incident reports, forensic findings, and RCA reports.
• Coordinate with internal teams and ensure regulatory reporting compliance (NCA).

Skills

Incident response

Digital forensics

Threat analysis

Education

Bachelor's degree in Cybersecurity / Digital Forensics / Computer Science

Tools

SIEM

EDR

EnCase

FTK

Volatility

Autopsy

Job description

CCDS is seeking an experienced Cybersecurity Incident Responder with 7+ years in DFIR to lead investigations in Riyadh on a project-based engagement (13 months). The role focuses on incident containment, evidence handling, and regulatory reporting per NCA requirements.

You will work on forensic analysis across disk, memory, network and endpoints, develop playbooks, and communicate findings to executives and technical teams. On-site in Riyadh is required.