Senior DFIR Guardian📣 Job Ad

About the Role

Cognna is seeking a Senior DFIR Guardian to join our team in Medina, Al Madinah, Saudi Arabia. This full-time role involves leading end-to-end forensic investigations across various platforms, from initial triage to identifying root causes and implementing preventative measures. The ideal candidate will possess 5-10 years of experience in a relevant field.

Key Responsibilities

• Lead and coordinate the DFIR team during active investigations, ensuring consistent methodology, evidence integrity, and efficient investigative processes.
• Conduct end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure, covering initial triage to root cause analysis.
• Identify Indicators of Compromise (IoCs), data exfiltration, and unauthorized access incidents.
• Extract and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct attack and user activity timelines.
• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories while maintaining a full chain of custody.
• Perform in-depth analysis of artifacts such as file systems, memory, registry, logs, and configuration states to reconstruct incident details.
• Correlate endpoint, network, and identity telemetry to form a comprehensive understanding of attacker behavior and system access.
• Develop AI-assisted workflows to automate evidence collection, pattern detection, and timeline generation, enhancing investigative capacity.
• Translate complex technical findings into clear, chronological narratives for executives and cross-functional stakeholders, avoiding jargon.
• Integrate investigation outcomes into detection rules, access controls, and policy improvements to enhance security posture.

Experience and Qualifications

• A minimum of 5 to 10 years of experience in Digital Forensics and Incident Response (DFIR).
• Demonstrated experience in leading forensic investigations across diverse technical environments.
• Proficiency in analyzing logs from various security platforms and reconstructing incident timelines.
• Experience with forensic imaging and artifact analysis.
• Ability to communicate complex technical information clearly to both technical and non-technical audiences.

Work Environment

This is a full-time position based in Medina, Al Madinah, Saudi Arabia. The role involves working within a dedicated team focused on cybersecurity investigations and improvements.

Application Process

Interested candidates are invited to apply. Salary details will be discussed during the interview process.