Staff DFIR

About COGNNA

COGNNA is a cybersecurity company focused on developing innovative solutions. The company integrates AI, real-time threat detection, and security insights to help organizations defend against cyber threats. This full-time position is based in Riyadh, Riyadh Province.

Role Overview: Staff DFIR

The Staff DFIR will be responsible for leading and conducting end-to-end forensic investigations. This role involves coordinating investigative efforts, analyzing various data sources, and translating technical findings into clear reports for stakeholders. The position requires 5-10 years of experience in a relevant field.

Key Responsibilities

• Lead end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure, from initial triage to root cause analysis, including IoC identification, data exfiltration, and unauthorized access.
• Coordinate and lead the DFIR team during active investigations, ensuring consistent methodology, evidence integrity, and investigative velocity.
• Analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct attack and user activity timelines.
• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories while maintaining a full chain of custody.
• Examine artifacts such as file systems, memory, registry, logs, and configuration states to reconstruct incident details.
• Correlate endpoint, network, and identity telemetry to form a comprehensive understanding of attacker behavior and system access.
• Develop AI-assisted workflows to automate evidence collection, pattern detection, and timeline generation, enhancing investigative capacity.
• Communicate technical findings through clear, chronological narratives for executives and cross-functional stakeholders.
• Integrate investigation outcomes into detection rules, access controls, and policy improvements.

Experience and Qualifications

• 5-10 years of experience in Digital Forensics and Incident Response (DFIR) or a related cybersecurity field.
• Demonstrated ability to lead complex forensic investigations.
• Proficiency in analyzing various security logs and forensic artifacts.
• Experience with forensic imaging and chain of custody procedures.

Benefits

• Impact: Contribute to cybersecurity product development.
• Collaboration: Work on-site in the Riyadh office with a team of experts.
• Professional Growth: Access to certifications, trainings, and development opportunities.
• Ownership: Participate in the ESOP program.
• Culture: Work in an environment that supports talent and celebrates outcomes.

Application Process

Candidates interested in this Staff DFIR position are encouraged to apply. Salary information will be discussed during the interview process.