Senior DFIR Lead: End-to-End Forensics & AI Workflows

COGNNA; Medina; On-site; SAR 540,000 - 720,000; Full time

Benefits offered by this job

ESOP program

Certifications & trainings

Job summary

COGNNA is seeking a senior Digital Forensics Investigator to own end-to-end investigations across endpoints, cloud, and networks. You will coordinate a DFIR team, ensure evidence integrity, and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateways to build precise timelines.

The role requires 5+ years in DFIR with strong English/Arabic communication, hands-on proficiency with FTK/X-Ways/Cellebrite/Axiom, and cross‑platform OS expertise.

Qualifications

• 5+ years in digital forensics, incident response, or security investigations.
• Exceptional written and verbal communication in English and Arabic.
• Hands-on proficiency with FTK, X-Ways, Cellebrite, Axiom.
• Strong command of network protocols and log analysis across SIEM.
• Scripting in Python/PowerShell/Bash to automate evidence processing.
• Deep knowledge of Windows, macOS, and Linux at artifact/system level.
• Experience integrating AI into investigative workflows.
• Saudi nationality is required.

Responsibilities

• Own end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure — from initial triage to root cause.
• Coordinate and lead the DFIR team across active investigations, ensuring consistent methodology and evidence integrity.
• Pull and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct timelines.
• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories with full chain of custody.
• Analyze artifacts — file systems, memory, registry, and logs — to reconstruct what happened and when.
• Correlate endpoint, network, and identity telemetry into attacker behavior.
• Build AI-assisted workflows that automate evidence collection and pattern detection.
• Translate technical findings into clear narratives for executives and cross-functional stakeholders.
• Close the loop: feed investigation outcomes back into detection rules and policy improvements.

Skills

Digital forensics

Incident response

Team coordination

Forensic tooling

Python scripting

Cross‑platform knowledge

Executive briefing

English & Arabic communication

Education

Bachelor’s in Cybersecurity or related field

Tools

FTK

X-Ways

Cellebrite

Axiom

Job description

COGNNA is seeking a senior Digital Forensics Investigator to own end-to-end investigations across endpoints, cloud, and networks. You will coordinate a DFIR team, ensure evidence integrity, and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateways to build precise timelines.

The role requires 5+ years in DFIR with strong English/Arabic communication, hands-on proficiency with FTK/X-Ways/Cellebrite/Axiom, and cross‑platform OS expertise.