Cybersecurity Incident Response Specialist

About the role

ExeQut is seeking a hands‑on Cybersecurity Incident Response Specialist to join its fast‑growing consulting team. You will investigate, contain, eradicate, and recover from security incidents across endpoints, networks, identities, cloud, and applications for public and private sector clients in Saudi Arabia.

Key responsibilities

• Investigate and respond to ransomware, malware, phishing, account compromise, data theft, and lateral movement incidents.
• Perform triage, containment, eradication, recovery, threat hunting, and root‑cause analysis.
• Conduct basic digital forensics and malware analysis.
• Identify IOCs/IOAs, map attacks to MITRE ATT&CK, and analyze Windows, Linux, Active Directory, and cloud environments.
• Leverage SIEM and EDR/XDR platforms (e.g., Splunk, Microsoft Sentinel, QRadar, CrowdStrike, SentinelOne, Microsoft Defender, Cortex XDR) to investigate security events.
• Develop and refine incident‑response playbooks, detection rules, and detailed incident reports with timelines and remediation recommendations.
• Support SOC/CSIRT operations and critical incident response.

Required profile

• Strong experience in Incident Response, DFIR, SOC, or Threat Hunting.
• Hands‑on experience with major SIEM and EDR/XDR tools.
• Deep knowledge of Windows, Linux, networking, and cloud environments.
• Proficiency in scripting languages such as PowerShell, Python, or Bash.
• Solid understanding of MITRE ATT&CK framework and common attack techniques.
• Saudi nationality is mandatory.

Required skills

• Splunk
• Microsoft Sentinel
• QRadar
• CrowdStrike
• SentinelOne
• Microsoft Defender
• Cortex XDR
• Windows
• Linux
• Networking
• PowerShell
• Python
• Bash
• MITRE ATT&CK

What we offer

• Performance‑based compensation structure.
• Bupa medical insurance (Golden Tier).
• Ongoing training and mentorship from experienced leadership.
• Exposure to high‑impact projects with leading Saudi clients.
• Collaborative, growth‑oriented culture.