Senior DFIR Investigator & Incident Response Lead

COGNNA; Riyadh; On-site; SAR 250,000 - 360,000; Full time

Benefits offered by this job

ESOP program

Certifications and trainings

On-site collaboration

Job summary

COGNNA is seeking a Senior Digital Forensics and Incident Response professional to lead end-to-end investigations across endpoints, cloud, and networks. You will coordinate DFIR teams, pull logs from SIEM/EDR, acquire forensic images with strict chain of custody, and analyze artifacts to reconstruct attack timelines.

Strong English/Arabic communication is essential. Role emphasizes translating complex findings for executives and integrating AI tools to automate evidence collection and reporting,

Qualifications

• Bachelor’s in Cybersecurity, International Relations, Computer Science, or related field.
• 3+ years in digital forensics, incident response, or security investigations, with leadership/coordination experience.
• Excellent written and verbal communication in English and Arabic.

Responsibilities

• Own end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure from triage to root cause.
• Coordinate and lead the DFIR team across active investigations.
• Pull and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms.
• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories with full chain of custody.
• Investigate artifacts across file systems, memory, registry, logs, and config states.
• Correlate telemetry into a coherent attacker behavior picture.
• Build AI-assisted workflows to scale evidence collection and timelines.
• Translate findings into clear narratives for executives and stakeholders.

Skills

Digital forensics

Incident response

Team coordination

Log analysis

Scripting (Python/PowerShell/Bash)

AI integration in investigations

Executive briefing

Regulatory compliance

Education

Bachelor’s in Cybersecurity

Tools

FTK

X-Ways

Cellebrite

Axiom

Job description

COGNNA is seeking a Senior Digital Forensics and Incident Response professional to lead end-to-end investigations across endpoints, cloud, and networks. You will coordinate DFIR teams, pull logs from SIEM/EDR, acquire forensic images with strict chain of custody, and analyze artifacts to reconstruct attack timelines.

Strong English/Arabic communication is essential. Role emphasizes translating complex findings for executives and integrating AI tools to automate evidence collection and reporting,