Senior DFIR Guardian

COGNNA; Riyadh; On-site; SAR 250,000 - 360,000; Full time

Benefits offered by this job

ESOP program

Certifications and trainings

On-site collaboration

Job summary

COGNNA is seeking a Senior Digital Forensics and Incident Response professional to lead end-to-end investigations across endpoints, cloud, and networks. You will coordinate DFIR teams, pull logs from SIEM/EDR, acquire forensic images with strict chain of custody, and analyze artifacts to reconstruct attack timelines.

Strong English/Arabic communication is essential. Role emphasizes translating complex findings for executives and integrating AI tools to automate evidence collection and reporting,

Qualifications

• Bachelor’s in Cybersecurity, International Relations, Computer Science, or related field.
• 3+ years in digital forensics, incident response, or security investigations, with leadership/coordination experience.
• Excellent written and verbal communication in English and Arabic.

Responsibilities

• Own end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure from triage to root cause.
• Coordinate and lead the DFIR team across active investigations.
• Pull and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms.
• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories with full chain of custody.
• Investigate artifacts across file systems, memory, registry, logs, and config states.
• Correlate telemetry into a coherent attacker behavior picture.
• Build AI-assisted workflows to scale evidence collection and timelines.
• Translate findings into clear narratives for executives and stakeholders.

Skills

Digital forensics

Incident response

Team coordination

Log analysis

Scripting (Python/PowerShell/Bash)

AI integration in investigations

Executive briefing

Regulatory compliance

Education

Bachelor’s in Cybersecurity

Tools

FTK

X-Ways

Cellebrite

Axiom

Job description

• Own end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure — from initial triage to root cause, including IoC identification, data exfiltration, and unauthorized access


• Coordinate and lead the DFIR team across active investigations, ensuring consistent methodology, evidence integrity, and investigative velocity


• Pull and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct precise attack and user activity timelines


• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories with full chain of custody


• Go deep on artifacts — file systems, memory, registry, logs, config states — to reconstruct exactly what happened and when


• Correlate endpoint, network, and identity telemetry into a coherent picture of attacker behavior and system access


• Build AI-assisted workflows that automate evidence collection, pattern detection, and timeline generation to scale investigative capacity


• Translate technical findings into clear, chronological narratives for executives and cross-functional stakeholders — no jargon, no ambiguity


• Close the loop: feed investigation outcomes back into detection rules, access controls, and policy improvements.

Education

• Bachelor’s in Cybersecurity, International Relations, Computer Science, or related field.

Experience

• 3+ years in digital forensics, incident response, or security investigations, with a track record leading or coordinating DFIR engagements


• Exceptional written and verbal communication in both English & Arabic.


• Hands‑on proficiency with forensic tooling: FTK, X-Ways, Cellebrite, Axiom, or equivalent platforms


• Strong command of network protocols (TCP/IP, HTTP/S, DNS) and log analysis across SIEM platforms


• Scripting ability in Python, PowerShell, or Bash — used to automate evidence processing, not just theoretically


• Deep working knowledge of Windows, macOS, and Linux/Unix environments at the artifact and system level


• Proven experience integrating AI tools into investigative workflows to accelerate triage, pattern detection, or reporting


• Clear, confident communicator — able to brief executives and work alongside legal, HR, and compliance teams without losing technical precision


• Compliance: Ensuring all operations align with NCA ECC and SAMA CSF regulations.

Certifications (Highly Preferred)

• SANS / GIAC (GCFA, GCFE, GNFA, GCIA or similar)


• IACIS CFCE


• EC-Council CHFI


• Offsec (OSDA, OSIR)
  

Impact that Matters – Build products that shape the future of cybersecurity and protect organizations globally.

On‑Site Collaboration – Be at the heart of innovation in our Riyadh office, working side by side with passionate experts.

Continuous Growth – Access to certifications, trainings, and opportunities to sharpen your expertise.

Ownership Mindset – Benefit from our ESOP program and grow with COGNNA’s success.

Culture of Trust – We empower talent, encourage ownership, and celebrate real outcomes.