Senior DFIR Investigator – 24/7 Incident Leadership

Group-IB; Riyadh; On-site; SAR 300,000 - 520,000; Full time

Job summary

Group-IB is seeking a Senior DFIR Specialist in Riyadh to lead complex investigations from initial contact to final report. You will serve as the first technical escalation point on your shift and guide other responders, ensuring thorough review before client delivery.

This hands-on role does not include people management but offers mentorship to junior staff and opportunities to contribute to playbooks and tooling improvements in a fast-paced security operations environment.

Qualifications

• Minimum of 5 years in DFIR or incident response roles, with cases you led yourself.
• Strong hands-on Windows, Linux and memory forensics.
• Experience with ransomware and targeted intrusion cases, including timeline building and root-cause analysis.
• Clear technical writing.
• High-level decision-making skills in dynamic and high-pressure environments.
• Fluent English.

Responsibilities

• Lead investigations end to end: scoping, triage, evidence collection, analysis, containment advice and reporting.
• Act as the first escalation point for the team and for clients on your shift.
• Make sound calls with incomplete data, balancing depth of analysis against speed of response.
• Brief client technical teams and executives in clear, non-technical language.

Skills

Windows forensics

Linux forensics

Memory forensics

Incident response

Technical writing

English fluency

Tools

GCFA

GCFR

GREM

GNFA

GCIH

Job description

Group-IB is seeking a Senior DFIR Specialist in Riyadh to lead complex investigations from initial contact to final report. You will serve as the first technical escalation point on your shift and guide other responders, ensuring thorough review before client delivery.

This hands-on role does not include people management but offers mentorship to junior staff and opportunities to contribute to playbooks and tooling improvements in a fast-paced security operations environment.