Senior DFIR Lead: Incident Response & Digital Forensics

CCDS; Riyadh; On-site; SAR 300,000 - 420,000; Full time

Job summary

CCDS in Riyadh, Saudi Arabia, seeks an experienced cybersecurity professional to lead incident response and digital forensics investigations. The role focuses on preserving evidence, complying with regulatory reporting, and coordinating with internal teams.

You will contain, eradicate, and recover from incidents, perform in-depth forensic analysis, and develop robust incident-response playbooks. A 13-month project-based engagement requires 7+ years of expertise and strong knowledge of MITRE

Qualifications

• Bachelor’s degree in Cybersecurity, Digital Forensics, Computer Science, or related field.
• 7+ years of experience in cyber incident response and digital forensics investigations.
• Strong knowledge of attacker behavior, incident investigation methods, NIST incident response, and MITRE ATT&CK.

Responsibilities

• Investigate incidents and determine scope, impact, entry vectors, and affected assets.
• Contain, eradicate, recover, perform root-cause analysis, and conduct post-incident reviews.
• Collect, preserve, and analyze digital evidence with proper chain of custody.
• Perform disk, memory, network, endpoint, and malware analysis using forensic tools.
• Develop and maintain incident-response procedures, playbooks, and evidence-handling guides.
• Prepare technical and executive incident reports and RCA findings.
• Coordinate with internal teams and ensure compliant incident classification and reporting with NCA requirements.

Skills

Incident response

Digital forensics

NIST incident response

MITRE ATT&CK

Forensic tools

Education

Bachelor's degree

Tools

EnCase

FTK

Volatility

Autopsy

SIEM

EDR

Job description

CCDS in Riyadh, Saudi Arabia, seeks an experienced cybersecurity professional to lead incident response and digital forensics investigations. The role focuses on preserving evidence, complying with regulatory reporting, and coordinating with internal teams.

You will contain, eradicate, and recover from incidents, perform in-depth forensic analysis, and develop robust incident-response playbooks. A 13-month project-based engagement requires 7+ years of expertise and strong knowledge of MITRE