Senior DFIR & Incident Response Specialist (On-site Riyadh)

ES Consulting; Riyadh; On-site; SAR 220,000 - 320,000; Full time

Job summary

ES Consulting in Riyadh is seeking a DFIR Specialist to lead incident response and digital forensics for a government entity, on-site in Riyadh.

You will analyze disks, memory, and network data, maintain evidence integrity, and develop IR playbooks while ensuring regulatory alignment with NCA.

Requires Bachelor's in related field and 7+ years' experience with EDR, SIEM, EnCase, FTK, Volatility, Autopsy; proficient with NIST and MITRE ATT&CK.

Qualifications

• Bachelor's degree in Cybersecurity, Digital Forensics, Computer Science, or related field.
• 7+ years of incident response and digital forensics experience.
• Hands-on experience with EDR, SIEM, EnCase, FTK, Volatility, and Autopsy.
• Strong knowledge of NIST IR frameworks and MITRE ATT&CK.

Responsibilities

• Lead investigations and response for cybersecurity incidents.
• Perform disk, memory, and network forensic analyses with proper chain of custody.
• Develop IR playbooks and DFIR procedures to improve readiness.
• Produce high-quality incident reports with root cause analysis.

Skills

Incident response

Digital forensics

Regulatory compliance

NIST IR

MITRE ATT&CK

Education

Bachelor's degree in Cybersecurity, Digital Forensics, Computer Science, or related field

Tools

EDR

SIEM

EnCase

FTK

Volatility

Autopsy

Job description

ES Consulting in Riyadh is seeking a DFIR Specialist to lead incident response and digital forensics for a government entity, on-site in Riyadh.

You will analyze disks, memory, and network data, maintain evidence integrity, and develop IR playbooks while ensuring regulatory alignment with NCA.

Requires Bachelor's in related field and 7+ years' experience with EDR, SIEM, EnCase, FTK, Volatility, Autopsy; proficient with NIST and MITRE ATT&CK.