Cybersecurity Incident Response & DFIR Specialist

About the role

CCDS is looking for a Cybersecurity Incident Response and Digital Forensics (DFIR) Specialist to lead and execute incident investigations while preserving evidence and meeting regulatory reporting requirements. The engagement is a project-based managed cybersecurity service of 13 months, on-site in Riyadh, Saudi Arabia.

Key responsibilities

• Investigate cybersecurity incidents and determine attack scope, impact, entry vectors and affected assets.
• Contain, eradicate and recover systems, perform root-cause analysis and post-incident reviews.
• Collect, preserve and analyse digital evidence following approved chain-of-custody procedures.
• Analyse disks, memory, networks, endpoints and malware with forensic tools.
• Maintain incident-response and DFIR procedures, playbooks, investigation methods and evidence-handling guides.
• Prepare technical and executive incident reports, forensic findings and RCA reports.
• Coordinate with internal teams and stakeholders and ensure incident classification and reporting meet NCA requirements.

Required profile

• Saudi nationality is a must.
• Bachelor's degree in Cybersecurity, Digital Forensics, Computer Science or a related field.
• At least 7 years of experience in cyber incident response and digital forensic investigations.
• Strong knowledge of attacker behaviour, incident investigation methods, NIST incident response and MITRE ATT&CK.
• Hands-on experience with SIEM, EDR, EnCase, FTK, Volatility, Autopsy or equivalent tools.
• Clear technical writing and the ability to explain findings to executives and technical teams.
• Calm, decisive under pressure, with strong investigative thinking, attention to detail, integrity and confidentiality.

Preferred certifications: CISSP, GCIA, GSEC, GCIH, CISM or equivalent.