Senior DFIR Guardian

📣 إعلان

منذ يومان

	نوع العقد	دوام كامل
	طبيعة الوظيفة	بالموقع
	الموقع	المدينة المنورة

وصف الوظيفة

About the Role

Cognna is seeking a Senior DFIR Guardian to join our team in Medina, Al Madinah, Saudi Arabia. This full-time role involves leading end-to-end forensic investigations across various platforms, from initial triage to identifying root causes and implementing preventative measures. The ideal candidate will possess 5-10 years of experience in a relevant field.

Key Responsibilities

Lead and coordinate the DFIR team during active investigations, ensuring consistent methodology, evidence integrity, and efficient investigative processes.
Conduct end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure, covering initial triage to root cause analysis.
Identify Indicators of Compromise (IoCs), data exfiltration, and unauthorized access incidents.
Extract and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct attack and user activity timelines.
Acquire forensic images from laptops, mobile devices, servers, and cloud repositories while maintaining a full chain of custody.
Perform in-depth analysis of artifacts such as file systems, memory, registry, logs, and configuration states to reconstruct incident details.
Correlate endpoint, network, and identity telemetry to form a comprehensive understanding of attacker behavior and system access.
Develop AI-assisted workflows to automate evidence collection, pattern detection, and timeline generation, enhancing investigative capacity.
Translate complex technical findings into clear, chronological narratives for executives and cross-functional stakeholders, avoiding jargon.
Integrate investigation outcomes into detection rules, access controls, and policy improvements to enhance security posture.

Experience and Qualifications

A minimum of 5 to 10 years of experience in Digital Forensics and Incident Response (DFIR).
Demonstrated experience in leading forensic investigations across diverse technical environments.
Proficiency in analyzing logs from various security platforms and reconstructing incident timelines.
Experience with forensic imaging and artifact analysis.
Ability to communicate complex technical information clearly to both technical and non-technical audiences.

Work Environment

This is a full-time position based in Medina, Al Madinah, Saudi Arabia. The role involves working within a dedicated team focused on cybersecurity investigations and improvements.