Staff DFIR COGNNA📣 Job Ad

About Cognna and the Role

Cognna is at the forefront of cybersecurity innovation, integrating advanced AI, real-time threat detection, and deep security insights to proactively defend organizations against evolving cyber threats. We are seeking a Staff DFIR professional to join our team in Riyadh. This full-time position requires 5-10 years of experience and involves leading comprehensive digital forensic and incident response investigations.

Key Responsibilities

• Own end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure, from initial triage to root cause analysis, including IoC identification, data exfiltration, and unauthorized access.
• Coordinate and lead the DFIR team during active investigations, ensuring consistent methodology, evidence integrity, and investigative velocity.
• Pull and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct precise attack and user activity timelines.
• Acquire forensic images from laptops, mobile devices, servers, and cloud repositories while maintaining a full chain of custody.
• Conduct deep analysis of artifacts, including file systems, memory, registry, logs, and config states, to reconstruct incident details.
• Correlate endpoint, network, and identity telemetry to form a coherent picture of attacker behavior and system access.
• Build AI-assisted workflows to automate evidence collection, pattern detection, and timeline generation, enhancing investigative capacity.
• Translate complex technical findings into clear, chronological narratives for executives and cross-functional stakeholders, avoiding jargon and ambiguity.
• Integrate investigation outcomes back into detection rules, access controls, and policy improvements to enhance security posture.

Required Qualifications and Experience

• Bachelor's degree in Cybersecurity, International Relations, Computer Science, or a related field.
• Minimum of 5 years of experience in digital forensics, incident response, or security investigations, with a proven track record of leading or coordinating DFIR engagements.
• Hands-on proficiency with forensic tooling such as FTK, X-Ways, Cellebrite, Axiom, or equivalent platforms.
• Strong command of network protocols (TCP/IP, HTTP/S, DNS) and log analysis across SIEM platforms.
• Scripting ability in Python, PowerShell, or Bash for automating evidence processing.
• Deep working knowledge of Windows, macOS, and Linux/Unix environments at the artifact and system level.
• Proven experience integrating AI tools into investigative workflows to accelerate triage, pattern detection, or reporting.
• Understanding of compliance requirements, ensuring all operations align with NCA ECC and SAMA CSF regulations.
• Previous leadership experience is required.

Preferred Certifications

• SANS / GIAC (GCFA, GCFE, GNFA, GCIA or similar)
• IACIS CFCE
• EC-Council CHFI
• Offsec (OSDA, OSIR)

Essential Skills

• Exceptional analytical thinking and creative problem-solving abilities.
• Strong mentorship capabilities and a collaborative spirit within a team environment.
• Self-motivated, focused, and passionate about cyber defense.
• Capable of managing multiple priorities effectively under high-pressure situations.

Working at Cognna

At Cognna, you will contribute to a team dedicated to shaping the future of cybersecurity. This role offers an opportunity to apply advanced forensic and incident response expertise in a dynamic and challenging environment, directly impacting organizational security posture.