Senior DFIR Guardian

About the Senior DFIR Guardian Role

Cognna is seeking a Senior DFIR Guardian to join its team in Riyadh, Saudi Arabia. This full-time role involves leading comprehensive digital forensics and incident response efforts, ensuring a robust security posture and effective threat mitigation within the organization.

Key Responsibilities

• Lead end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure, from initial triage to root cause analysis, including IoC identification, data exfiltration, and unauthorized access.
• Coordinate and lead the DFIR team during active investigations, ensuring consistent methodology, evidence integrity, and efficient investigative processes.
• Analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct precise attack and user activity timelines.
• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories while maintaining a full chain of custody.
• Conduct in-depth analysis of artifacts such as file systems, memory, registry, logs, and configuration states to reconstruct incident details.
• Correlate endpoint, network, and identity telemetry to develop a comprehensive understanding of attacker behavior and system access.
• Develop AI-assisted workflows to automate evidence collection, pattern detection, and timeline generation, enhancing investigative capacity.
• Translate complex technical findings into clear, chronological narratives for executives and cross-functional stakeholders, avoiding jargon and ambiguity.
• Integrate investigation outcomes into detection rules, access controls, and policy improvements to enhance security posture.

Required Experience

Candidates for this role should possess 5-10 years of experience in Digital Forensics and Incident Response (DFIR) or a closely related cybersecurity field. This experience should include hands-on involvement in complex security investigations.

Technical Expertise

The role requires demonstrated expertise in forensic investigation tools and methodologies across various environments, including endpoints, cloud platforms, and network infrastructure. Proficiency with security platforms such as EDR/XDR, SIEM, DLP, and IdP is essential, alongside experience in acquiring and analyzing forensic images from diverse sources.

Key Competencies

Successful candidates will demonstrate strong analytical skills, the ability to lead and coordinate investigative teams, and excellent communication skills to articulate technical findings to both technical and non-technical audiences. A commitment to maintaining evidence integrity and driving continuous security improvements is essential for this position.

Work Environment

This is a full-time position based in Riyadh, Saudi Arabia. The Senior DFIR Guardian will operate within a dynamic cybersecurity environment, contributing to critical incident response and forensic analysis operations at Cognna.