Digital Forensics & Incident Response (DFIR) Analyst
Role Overview
Investigates cybersecurity incidents, performs digital forensic investigations, and supports enterprise incident response to protect critical assets.
Focus areas include digital forensics, incident response, evidence collection, malware analysis, threat hunting, and root cause analysis.
Supports identification, containment, eradication, and recovery while preserving forensic integrity and strengthening security posture.
Key Skills for This Role
Full Job Posting
Role overview
Investigates cybersecurity incidents, performs digital forensic investigations, and supports enterprise incident response to protect critical assets.
Focus areas include digital forensics, incident response, evidence collection, malware analysis, threat hunting, and root cause analysis.
Supports identification, containment, eradication, and recovery while preserving forensic integrity and strengthening security posture.
Responsibilities
- Investigate incidents across endpoints, servers, cloud environments, and enterprise networks through host, network, and breach analysis.
- Support the full incident response lifecycle, including identification, triage, containment, eradication, recovery, and post-incident analysis.
- Collect evidence and artifacts, perform forensic and disk imaging, and maintain chain of custody and forensic integrity.
- Perform memory, disk, Windows, Linux, and network forensics to determine incident scope and impact.
- Investigate malware, ransomware, phishing, insider threats, account compromise, and other advanced cyber threats.
- Conduct root cause and timeline analysis to reconstruct attacks and identify attack vectors.
- Analyze IOCs, IOAs, and adversary TTPs to support investigations and threat hunting.
- Use Volatility, Autopsy, FTK, EnCase, SIEM platforms, and EDR/XDR solutions to analyze artifacts, memory, logs, and network traffic.
- Analyze logs across operating systems, applications, security devices, and cloud platforms.
- Coordinate with SOC, threat intelligence, IT infrastructure, cloud operations, and other stakeholders.
- Prepare case documentation, investigation reports, executive summaries, forensic findings, timelines, and remediation recommendations.
- Improve playbooks, forensic procedures, investigation methods, evidence handling, and DFIR capabilities.
Candidate profile
- Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Digital Forensics, or a related field.
- At least two years of DFIR experience, including hands-on incident investigation and enterprise incident response.
- Experience with evidence collection, memory and disk forensics, malware analysis, threat hunting, root cause analysis, IOC and timeline analysis, and log analysis.
- Experience using forensic tools such as Volatility, Autopsy, FTK, or EnCase and enterprise SIEM/EDR platforms.
- Relevant cybersecurity certifications are preferred.
Compensation and benefits
- The posting refers to a monthly salary but does not state an amount.
- Benefits include social allowance, mobile allowance, and medical insurance for the employee, family, and parents.
Job nature
The description identifies the job nature as project-based.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at SITE سايت
SIEM Administrator
, KSA
SITE seeks a SIEM Administrator to administer, maintain, and optimize its Security Information and Event Management platform for effective security monitoring, log management, and threat detection. The role covers log so
Senior Director - Cloud Customer Engagement
, KSA
SITE is seeking a Senior Director to own customer engagement strategy, annual targets, and growth across public and private sector cloud portfolios. The role focuses on new-logo acquisition, pipeline acceleration, value