Digital Forensics & Incident Response (DFIR) Consultant

About the Role

ZainTECH is seeking a Digital Forensics & Incident Response (DFIR) Consultant to join their team in Riyadh, Saudi Arabia. This full-time role involves investigating cybersecurity incidents, conducting digital forensic examinations, and supporting the containment, eradication, and recovery of security threats across customer environments. The consultant will provide specialized technical expertise in incident investigation, evidence preservation, compromise assessments, and advanced threat analysis.

Key Responsibilities

• Conduct digital forensic investigations across endpoints, servers, networks, and cloud environments to identify malicious activity and security compromises.
• Acquire, preserve, and analyze digital evidence, including memory, system artifacts, and security logs, to determine incident scope, root cause, and potential impact.
• Lead technical response activities for major security incidents escalated by SOC Analysts, investigating attack vectors and affected systems.
• Coordinate technical containment, eradication, recovery, and post-incident monitoring activities with relevant stakeholders.
• Perform initial analysis and triage of malware, phishing emails, suspicious files, and exploit artifacts to identify malicious behavior.
• Investigate suspicious activities across Microsoft 365, Microsoft Entra ID, and other enterprise platforms.
• Identify opportunities to improve security monitoring and detection capabilities based on forensic investigations and incident findings.
• Develop and recommend detection logic, including Sigma rules and detection use cases, for implementation by Cybersecurity Engineering teams.
• Prepare comprehensive technical investigation reports outlining incident timelines, findings, root causes, and recommended remediation actions.
• Communicate investigation progress, technical findings, and response recommendations to customers and internal stakeholders.
• Support applicable Saudi Arabian cybersecurity and data protection requirements, including those of the National Cybersecurity Authority (NCA) and Saudi Central Bank (SAMA).

Qualifications and Experience

• Minimum 3 years of hands-on experience in digital forensics, incident response, or cybersecurity investigations.
• Practical experience conducting forensic investigations and handling digital evidence using tools such as Velociraptor, KAPE, Volatility, and Endpoint Detection and Response (EDR) platforms.
• Strong understanding of digital forensic methodologies, evidence acquisition, preservation, analysis, and chain-of-custody requirements.
• Experience analyzing endpoint, server, network, and cloud security logs to investigate security incidents.
• Hands-on knowledge of security investigations involving Microsoft 365 and Microsoft Entra ID.
• Working knowledge of Security Information and Event Management (SIEM) platforms and security monitoring technologies.
• Experience using Python or PowerShell for scripting, investigation support, and task automation.
• Understanding of incident response methodologies, including identification, containment, eradication, recovery, and post-incident analysis.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.

Preferred Certifications

• GCFA, GCFE, GCIH, or GNFA.
• GCFR (SANS FOR509) for cloud forensics is a plus.

Skills and Attributes

• Strong analytical, investigative, and problem-solving skills.
• Ability to communicate technical findings effectively to various stakeholders.
• Ability to provide clear and actionable guidance for customer remediation and security improvement activities.