Senior DFIR Guardian

About the Role

COGNNA is seeking a Senior DFIR Guardian to lead end-to-end forensic investigations. This full-time position is based in Medina, Al Madinah Province, and involves managing investigations across endpoints, cloud platforms, and network infrastructure, from initial triage to root cause analysis.

Key Responsibilities

• Conduct forensic investigations covering initial triage, root cause analysis, IoC identification, data exfiltration, and unauthorized access.
• Coordinate and lead the DFIR team during active investigations, ensuring consistent methodology, evidence integrity, and investigative velocity.
• Analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct attack and user activity timelines.
• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories while maintaining a full chain of custody.
• Examine artifacts such as file systems, memory, registry, logs, and configuration states to determine incident specifics.
• Correlate endpoint, network, and identity telemetry to form a comprehensive view of attacker behavior and system access.
• Develop AI-assisted workflows to automate evidence collection, pattern detection, and timeline generation, enhancing investigative capacity.
• Communicate technical findings to executives and cross-functional stakeholders through clear, chronological narratives, avoiding jargon.
• Integrate investigation outcomes into detection rules, access controls, and policy improvements.

Qualifications and Experience

• 5-10 years of experience in a relevant field.
• Ability to ensure all operations comply with NCA ECC and SAMA CSF regulations.

Benefits and Growth

• Opportunity to contribute to cybersecurity products that protect organizations globally.
• On-site collaboration within the Almadina office.
• Access to certifications, training, and professional development opportunities.
• Participation in the ESOP program.
• Work within a culture that values talent, ownership, and measurable results.