Lead End-to-End Cybersecurity Incident Response

Job description

Join a GIAC Certified Reliable Company in Riyadh, Saudi Arabia. The role leads comprehensive cybersecurity incident response covering containment, investigation, eradication, and recovery. Manage digital evidence preservation and chain of custody across repositories, endpoints, and cloud environments. Investigate software supply-chain compromises involving CI/CD pipelines, GitHub/GitLab, and developer endpoints. Identify root cause, patient zero, and infection timeline through forensic analysis. Conduct threat hunting across DNS, NAT, proxy, firewall, EDR, and cloud logs. Analyze obfuscated JavaScript malware and develop YARA detection rules. Oversee endpoint rebuilding, credential rotation, Git history remediation, and cloud workload recovery. Prepare forensic investigation, eradication, and incident closure reports. Provide daily incident updates and technical briefings to stakeholders

Requirements

• 10+ years hands‑on experience in Incident Response (IR) and Digital Forensics
• Active GIAC GCIA certification plus at least one of: GIAC GCIH
• GIAC GCFA
• GIAC GREM
• Proven experience leading incident response engagements as the designated Incident Lead
• Experience investigating software supply‑chain, CI/CD, or GitHub/GitLab compromises
• Strong knowledge of Git internals and history rewriting using git filter‑repo
• Experience in cloud forensics, preferably Google Cloud Platform (GCP/GKE)
• Proficiency in JavaScript malware analysis and YARA detections

Skills