Cybersecurity Incident Response & Digital Forensics (DFIR) Specialist

Job description

Contract: Project-based managed cybersecurity services for 13 months. Role Purpose: Lead and execute cybersecurity incident response and digital forensic investigations while preserving evidence and meeting regulatory reporting requirements. Key Responsibilities: Investigate cybersecurity incidents and determine attack scope, impact, entry vectors, and affected assets; perform containment, eradication, recovery, root‑cause analysis, and post‑incident review; collect, preserve, and analyze digital evidence in accordance with approved chain‑of‑custody procedures; conduct disk, memory, network, endpoint, and malware analysis using appropriate forensic tools; develop and maintain incident‑response and DFIR procedures, playbooks, investigation methods, and evidence‑handling guides; prepare technical and executive incident reports, forensic findings, and RCA reports; coordinate with internal teams and stakeholders and ensure incident classification and reporting comply with NCA requirements.

Requirements

• Saudi nationality is a must
• Bachelor’s degree in Cybersecurity, Digital Forensics, Computer Science, or a related field
• at least 7 years of experience in cyber incident response and digital forensic investigations
• strong knowledge of attacker behavior, incident investigation methods, NIST incident response, and MITRE ATT&CK
• hands‑on experience with SIEM, EDR, EnCase, FTK, Volatility, Autopsy, or equivalent forensic and security tools
• strong understanding of digital evidence handling and chain of custody
• calm and decisive during high‑pressure incidents
• strong investigative thinking, attention to detail, and professional judgment
• clear technical writing and ability to communicate findings to executives and technical teams
• high integrity and strict respect for confidentiality
• preferred certifications: CISSP, GCIA, GSEC, GCIH, CISM, or equivalent.

Skills