Senior Digital Forensics & Incident Response Engineer

About the role

COGNNA is looking for a senior Digital Forensics and Incident Response (DFIR) professional to own end‑to‑end investigations across endpoints, cloud platforms, and network infrastructure. You will lead the DFIR team, ensure evidence integrity, and translate complex technical findings into clear executive briefings.

Key responsibilities

• Conduct full forensic investigations from triage to root‑cause analysis, including IoC identification and data exfiltration detection.
• Coordinate and lead the DFIR team across active cases, maintaining consistent methodology and investigative velocity.
• Collect and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateways to build precise attack timelines.
• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories with full chain of custody.
• Deep‑dive into artifacts such as file systems, memory, registry, and configuration states.
• Correlate endpoint, network, and identity telemetry to map attacker behavior.
• Develop AI‑assisted workflows to automate evidence collection, pattern detection, and timeline generation.
• Produce clear, chronological narratives for executives and cross‑functional stakeholders.
• Feed investigation outcomes back into detection rules, access controls, and policy improvements.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science, International Relations or related field.
• 5+ years of experience in digital forensics, incident response, or security investigations, with proven leadership of DFIR engagements.
• Excellent written and verbal communication in English and Arabic.
• Strong understanding of NCA ECC and SAMA CSF compliance requirements.

Required skills

• Hands‑on experience with forensic tools such as FTK, X‑Ways, Cellebrite, Axiom.
• Proficiency in scripting languages: Python, PowerShell, Bash.
• Deep knowledge of Windows, macOS, and Linux/Unix environments.
• Strong command of network protocols (TCP/IP, HTTP/HTTPS, DNS) and log analysis.
• Experience with SIEM, EDR/XDR, DLP, IdP, and email gateway platforms.