Cybersecurity Incident Response & DFIR Specialist

About the role

We are seeking an experienced Cybersecurity Incident Response & Digital Forensics (DFIR) Specialist to lead and execute incident response activities for a 13‑month managed security project in Riyadh. The role requires deep technical expertise, decisive action during high‑pressure events, and strict adherence to evidence‑handling and regulatory reporting standards.

Key responsibilities

• Investigate cybersecurity incidents to determine scope, impact, entry vectors, and affected assets.
• Perform containment, eradication, recovery, root‑cause analysis, and post‑incident review.
• Collect, preserve, and analyze digital evidence following chain‑of‑custody procedures.
• Conduct disk, memory, network, endpoint, and malware analysis using forensic tools.
• Develop and maintain incident‑response and DFIR playbooks, procedures, and evidence‑handling guides.
• Prepare technical and executive incident reports, forensic findings, and RCA documentation.
• Coordinate with internal teams and ensure compliance with NCA reporting requirements.

Required profile

• Saudi nationality.
• Bachelor’s degree in Cybersecurity, Digital Forensics, Computer Science or a related field.
• Minimum 7 years of hands‑on experience in cyber incident response and digital forensics.
• Strong knowledge of attacker behavior, NIST incident response framework, and MITRE ATT&CK matrix.
• Calm, decisive, and detail‑oriented under pressure with high integrity and confidentiality.

Required skills

• SIEM platforms
• EDR solutions
• EnCase
• FTK
• Volatility
• Autopsy
• NIST incident response methodology
• MITRE ATT&CK framework
• Digital evidence handling and chain‑of‑custody procedures