Digital Forensics & Incident Response (DFIR) Consultant

About the Role

ZainTECH is seeking a Digital Forensics & Incident Response (DFIR) Consultant to join their team in Riyadh, Riyadh Province. This full-time role involves investigating cybersecurity incidents, conducting digital forensic examinations, and supporting the containment, eradication, and recovery of security threats within customer environments. The consultant will provide specialized technical expertise in incident investigation, evidence preservation, compromise assessments, and advanced threat analysis, requiring 3-5 years of relevant experience.

Key Responsibilities

• Conduct digital forensic investigations across endpoints, servers, networks, and cloud environments to identify evidence of malicious activity and security compromise.
• Acquire, preserve, and analyze digital evidence, including memory, system artifacts, and security logs, to determine incident scope, root cause, and potential impact.
• Lead technical response activities for major security incidents escalated by Level 2 and Level 3 SOC Analysts.
• Coordinate technical containment, eradication, recovery, and post-incident monitoring activities with relevant stakeholders.
• Perform initial analysis and triage of malware, phishing emails, suspicious files, and exploit artifacts to identify malicious behavior and indicators of compromise.
• Analyze endpoint, network, and cloud security telemetry to identify attack patterns and potential threats.
• Identify opportunities to improve security monitoring and detection capabilities based on forensic investigations and incident findings.
• Develop and recommend detection logic, including Sigma rules, indicators, and detection use cases, for implementation by Cybersecurity Engineering teams.
• Prepare comprehensive technical investigation reports outlining incident timelines, findings, root causes, impact assessments, and recommended remediation actions.
• Communicate investigation progress, technical findings, and response recommendations to customers and internal stakeholders.

Digital Forensics and Incident Investigation

• Maintain accurate chain-of-custody records and ensure forensic evidence is handled, documented, and preserved in accordance with established procedures.
• Perform forensic analysis of compromised systems to reconstruct attack timelines, identify indicators of compromise (IOCs), and determine attacker activities.
• Utilize forensic investigation tools and methodologies to support accurate and defensible technical findings.

Incident Response and Threat Containment

• Investigate security incidents to determine attack vectors, affected systems, potential exposure, and appropriate remediation actions.
• Conduct compromise assessments to identify indicators of intrusion, unauthorized access, and other suspicious activities across customer environments.
• Support root cause analysis and post-incident reviews to identify security weaknesses and recommend corrective measures.

Malware Analysis and Threat Investigation

• Investigate suspicious activities across Microsoft 365, Microsoft Entra ID, and other enterprise platforms.
• Collaborate with Cyber Threat Intelligence teams to incorporate relevant threat intelligence into investigations and response activities.
• Translate investigation findings into actionable recommendations to improve threat detection and response capabilities.

Customer Engagement and Compliance

• Provide clear and actionable guidance to support customer remediation and security improvement activities.
• Provide technical evidence and investigation findings to the Line Manager to support regulatory notifications, compliance requirements, and formal investigations.
• Support applicable Saudi Arabian cybersecurity and data protection requirements, including those of the National Cybersecurity Authority (NCA), Saudi Central Bank (SAMA), and Personal Data Protection Law (PDPL), where relevant.
• Maintain accurate case documentation and ensure investigations are completed in accordance with established operational procedures and service requirements.

Company Culture

At ZainTECH, the culture emphasizes collaboration, innovation, and integrity. Employees are expected to uphold the company's Code of Conduct, which guides responsible behavior in interactions with colleagues, clients, and partners.