Senior DFIR Consultant - 24/7 Incident Response Lead

Group-IB; Riyadh; On-site; SAR 300,000 - 550,000; Full time

Job summary

Group-IB is seeking a Senior DFIR Consultant to lead complex cybersecurity investigations. You will be the first technical escalation point on your shift, guiding responders and reviewing work before client delivery.

This hands-on role involves 24/7 coverage, incident leadership, and clear technical reporting. You will mentor juniors and help improve tooling while staying ahead of evolving threats.

Qualifications

• Minimum of 5 years in DFIR or incident response roles, with cases you led.
• Strong hands-on Windows, Linux and memory forensics.
• Experience with ransomware and targeted intrusion cases, including timeline building and root-cause analysis.
• Clear technical writing.
• High-level decision-making skills in dynamic and high‑pressure environments.
• Fluent English.

Responsibilities

• Provide continuous 24/7 service on a shared rotation, including weekends.
• Travel onsite to support clients during critical incidents.
• Investigate hands-on across Windows, Linux and memory forensics.
• Lead investigations end to end: scoping, triage, evidence collection, analysis, containment advice and reporting.
• Act as the first escalation point for the team and for clients on your shift.
• Make sound calls with incomplete data, balancing depth of analysis against speed of response.
• Brief client technical teams and executives in clear, non-technical language.
• Write and own final investigation reports that clients, insurers and regulators rely on.
• Review the reports and findings of colleagues before delivery.
• Turn case lessons into playbooks, detection ideas and internal knowledge.

Skills

DFIR

Incident response

Windows forensics

Linux forensics

Memory forensics

Ransomware experience

Timeline analysis

Technical writing

Decision-making

Fluent English

Tools

GCFA

GCFR

GREM

GNFA

GCIH

Job description

Group-IB is seeking a Senior DFIR Consultant to lead complex cybersecurity investigations. You will be the first technical escalation point on your shift, guiding responders and reviewing work before client delivery.

This hands-on role involves 24/7 coverage, incident leadership, and clear technical reporting. You will mentor juniors and help improve tooling while staying ahead of evolving threats.