Job summary
ZainTECH in Riyadh is hiring a Digital Forensics & Incident Response (DFIR) Consultant to investigate cybersecurity incidents, perform forensic examinations, and support containment, eradication and recovery across customer environments. The role includes malware analysis, compromise assessments, detection improvements and producing technical investigation reports.
Key responsibilities
- Conduct forensic investigations across endpoints, servers, networks and cloud environments.
- Acquire, preserve and analyze digital evidence with proper chain-of-custody.
- Lead technical incident response and coordinate containment, eradication and recovery.
- Perform malware triage and analyze suspicious files, emails and artifacts.
- Analyze telemetry from endpoints, networks and cloud platforms for attack patterns.
- Develop detection logic and recommend detection use cases and Sigma rules.
- Prepare technical investigation reports and communicate findings to stakeholders.
- Support compliance-related reporting and case documentation for regulatory needs.
Requirements
- Minimum 3 years hands-on experience in digital forensics or incident response.
- Practical use of Velociraptor, KAPE, Volatility and EDR platforms.
- Strong knowledge of evidence acquisition, preservation and chain-of-custody.
- Experience analyzing endpoint, server, network and cloud logs.
- Hands-on experience with Microsoft 365 and Microsoft Entra ID investigations.
- Working knowledge of SIEM and security monitoring technologies.
- Experience using Python or PowerShell for scripting and automation.
- Fluency in written and spoken English.
Skills
Digital ForensicsIncident ResponseVelociraptorKAPEVolatilityEDRSIEMPythonPowerShellMalware Analysis
Source: Workable. Last checked as open: 14 Nov 2026. You apply directly with the employer.
Apply now
