Senior DFIR Consultant

About the Role

Group-IB is seeking a Senior DFIR Consultant to join their team in Riyadh, Saudi Arabia. This full-time role involves leading complex cybersecurity investigations from initial contact through to final reporting. The consultant will serve as the primary technical escalation point during their shift, guiding other responders and reviewing their work before client delivery. This is a hands-on technical position focused on incident response, not people management or strategic team development.

DFIR Vision and Approach

The DFIR team aims to combat cybercrime through continuous learning and proactive defense strategies. The approach involves integrating various security experts to build comprehensive defenses, gaining practical experience from a high volume of cases. The focus is on providing clients with clear, actionable answers and insights into incidents, rather than technical data, while also researching future automated cyber threats.

Key Responsibilities

• Provide continuous 24/7 service on a shared rotation, including weekends.
• Travel onsite to support clients during critical incidents.
• Conduct hands-on investigations across Windows, Linux, and memory forensics.
• Lead investigations end-to-end, covering scoping, triage, evidence collection, analysis, containment advice, and reporting.
• Act as the first escalation point for the team and clients during assigned shifts.
• Make informed decisions with incomplete data, balancing analysis depth with response speed.
• Brief client technical teams and executives using clear, non-technical language.
• Write and take ownership of final investigation reports for clients, insurers, and regulators.
• Review reports and findings from colleagues prior to delivery.
• Translate case lessons into playbooks, detection ideas, and internal knowledge.
• Mentor Middle and Junior specialists on live cases.
• Share knowledge through internal trainings, write-ups, blog posts, or conference talks.
• Contribute to the improvement of tooling and automation within the investigative workflow.

Qualifications and Experience

• 5-10 years of experience in DFIR or a related cybersecurity field.
• Demonstrated ability to lead complex cybersecurity investigations.
• Proficiency in Windows, Linux, and memory forensics.
• Experience in incident leadership, including scoping, triage, evidence collection, analysis, containment, and reporting.
• Strong communication skills for briefing technical and executive audiences.
• Ability to produce high-quality investigation reports.

About Group-IB

Group-IB is a global cybersecurity company specializing in investigating, predicting, preventing, and combating digital crime. The company provides adversary-focused, predictive threat intelligence and cyber fraud fusion solutions to reduce risk and protect trust for organizations, governments, major industries, and law enforcement agencies globally. Group-IB has conducted over 1,550 cybercrime investigations and works with over 600 enterprise customers across more than 60 countries.

Professional Development

Group-IB supports professional growth through funding for certifications such as CEH, CISSP, OSCP, and specialized forensics and penetration testing credentials. Employees have opportunities to deepen their technical expertise, pursue leadership roles, move to other teams, or relocate to one of the company's Digital Crime Resistance Centers across various regions. The company's Unified Risk Platform is recognized by industry analysts including Gartner and Forrester.