Digital Incident Response (Saudi National)📣 Job Ad

Role Overview

Robert Walters is seeking a Digital Incident Response professional to join a leading technology and cybersecurity organisation in Riyadh. This full-time position involves leading advanced security solutions and protecting critical technologies against sophisticated cyber threats.

About the Client

The client is a prominent technology and cybersecurity organisation focused on advanced security solutions across digital infrastructure, connected devices, embedded systems, and emerging technologies. Their expertise includes hardware and software security, vulnerability research, penetration testing, cryptography, and security assessments, helping organisations identify risks, strengthen systems, and protect critical technologies.

Core Responsibilities

• Lead end-to-end digital forensic investigations across endpoints, cloud platforms, and networks, from initial triage through root-cause analysis.
• Investigate unauthorised access, data exfiltration, Indicators of Compromise (IoCs), and attacker activity.
• Lead and coordinate the DFIR team during active investigations, ensuring consistent processes, evidence integrity, and timely outcomes.
• Collect and analyse logs from EDR/XDR, SIEM, DLP, Identity Providers (IdP), and email security platforms to reconstruct attack timelines.
• Acquire forensic images from laptops, mobile devices, servers, and cloud environments, maintaining a complete chain of custody.
• Analyse forensic artifacts including file systems, memory, Windows Registry, system logs, and configuration data to establish incident details.
• Correlate endpoint, network, and identity data to build a complete picture of attacker behaviour and system access.
• Develop and implement AI-assisted investigation workflows to automate evidence collection, pattern detection, and timeline generation.
• Present technical findings in clear, concise reports and timelines for executives and non-technical stakeholders.
• Work with security teams to integrate investigation findings into improvements for detection rules, access controls, security policies, and processes.

Candidate Profile

The ideal candidate will possess 5-10 years of experience in digital forensics and incident response. This role requires demonstrated expertise in leading complex investigations, performing root-cause analysis, and coordinating DFIR teams. Proficiency in collecting and analysing data from various security platforms and forensic artifacts is essential.

Regulatory Adherence

A key aspect of this role involves ensuring that all investigations and security operations strictly comply with NCA ECC and SAMA CSF requirements.

Position Details

This is a full-time position based in Riyadh. Salary for this role will be discussed directly with qualified candidates.