Digital Forensics & Incident Response (DFIR) Analyst

About the Role

Site is seeking a Digital Forensics & Incident Response (DFIR) Analyst to join their team in Riyadh, Saudi Arabia. This full-time role is responsible for investigating cybersecurity incidents, performing digital forensic investigations, and supporting enterprise incident response activities. The position focuses on protecting the organization's critical assets through expertise in Digital Forensics, Incident Response (DFIR), Evidence Collection, Malware Analysis, Threat Hunting, and Root Cause Analysis.

Role Purpose and Focus

The primary objective of this role is to identify, contain, eradicate, and recover from security incidents while preserving forensic integrity. The analyst will contribute to strengthening the organization's overall security posture by conducting thorough investigations and analysis of various cyber threats. This is a project-based role requiring a proactive approach to incident management.

Key Responsibilities

• Investigate cybersecurity incidents through Incident Investigation, Host Analysis, Network Analysis, and Breach Analysis across endpoints, servers, cloud environments, and enterprise networks.
• Lead or support incident response activities throughout the incident lifecycle, including identification, triage, threat containment, eradication, recovery, and post-incident analysis.
• Perform Evidence Collection, Artifact Collection, Forensic Imaging, and Disk Imaging while maintaining Chain of Custody and forensic integrity.
• Conduct Memory Analysis and Memory Dump Analysis to identify malicious activity, persistence mechanisms, and attacker techniques.
• Perform Disk Forensics, Windows Forensics, Linux Forensics, and Network Forensics to determine the scope and impact of security incidents.
• Investigate malware, ransomware, phishing attacks, insider threats, account compromise, and other advanced cyber threats through Malware Analysis and Malware Triage.
• Perform Root Cause Analysis, Timeline Analysis, and Timeline Creation to reconstruct attack activity and determine attack vectors.
• Identify, analyze, and extract Indicators of Compromise (IOC Analysis and IOC Extraction), Indicators of Attack (IOAs), and adversary Tactics, Techniques, and Procedures (TTPs) to support incident investigations and Threat Hunting activities.
• Utilize forensic and investigation tools such as Volatility, Autopsy, FTK, EnCase, SIEM platforms, and Endpoint Detection and Response (EDR/XDR) solutions.
• Perform Log Analysis across operating systems, applications, security devices, and cloud platforms to identify malicious activity and support forensic investigations.
• Coordinate with SOC, Threat Intelligence, IT Infrastructure, Cloud Operations, and other stakeholders during incident investigations and response activities.
• Develop comprehensive Case Documentation, investigation reports, executive summaries, forensic findings, technical timelines, and remediation recommendations.
• Maintain and improve incident response playbooks, forensic procedures, investigation methodologies, and digital evidence handling processes.
• Contribute to the continuous improvement of the organization's Digital Forensics, Incident Response (DFIR), Threat Hunting, and cyber incident response capabilities.

Experience and Qualifications

Candidates should possess 2-5 years of experience in a relevant field. Specific qualifications were not provided, but a strong background in the responsibilities listed above is expected.

Work Environment

This is a full-time, project-based position located in Riyadh, Saudi Arabia. The role involves collaboration with various internal teams and stakeholders to ensure effective incident response and security posture improvement.

Application Process

Salary for this position will be disclosed during the application process. Interested candidates are encouraged to apply.