Senior DFIR Lead — End-to-End Incident Response & Forensics

COGNNA; Medina; On-site; SAR 300,000 - 550,000; Full time

Benefits offered by this job

ESOP program

On-site Almadina office

Certifications & trainings

Job summary

COGNNA seeks a senior DFIR investigator to own end-to-end investigations across endpoints, cloud, and networks from triage to root cause. You will lead the DFIR team, ensure evidence integrity, and drive investigative velocity using FTK, X-Ways, Cellebrite, and Axiom across Windows, macOS, and Linux environments.

You will pull logs from EDR/XDR, SIEM, DLP, IdP, and email gateways, reconstruct timelines, and convert technical findings into clear executive narratives with minimal jargon.

Qualifications

• Bachelor's degree in a relevant field.
• ],
• job_responsibilities_description

Responsibilities

• Lead end-to-end DFIR investigations across endpoints, cloud, and networks.
• Coordinate and lead the DFIR team across active investigations.
• Pull and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateways.
• Acquire forensic images with full chain of custody.
• Analyze artifacts to reconstruct events and attacker patterns.
• Correlate telemetry to form a coherent attacker profile.
• Develop AI-assisted workflows to scale evidence collection and timelines.
• Translate findings for executives without jargon.
• Close the loop by feeding outcomes into detection, access controls, and policy.

Skills

DFIR leadership

Scripting (Python, PowerShell, Bash)

AI-assisted workflows

English & Arabic communication

Forensics & incident response

Education

Bachelor's in Cybersecurity

Tools

FTK

X-Ways

Cellebrite

Axiom

Job description

COGNNA seeks a senior DFIR investigator to own end-to-end investigations across endpoints, cloud, and networks from triage to root cause. You will lead the DFIR team, ensure evidence integrity, and drive investigative velocity using FTK, X-Ways, Cellebrite, and Axiom across Windows, macOS, and Linux environments.

You will pull logs from EDR/XDR, SIEM, DLP, IdP, and email gateways, reconstruct timelines, and convert technical findings into clear executive narratives with minimal jargon.