Digital Forensics & Incident Response (DFIR) Consultant

About the Role

Key Responsibilities

• Conduct digital forensic investigations across endpoints, servers, networks, and cloud environments to identify evidence of malicious activity and security compromise.
• Acquire, preserve, and analyze digital evidence, including memory, system artifacts, and security logs, to determine incident scope, root cause, and potential impact.
• Lead technical response activities for major security incidents escalated by Level 2 and Level 3 SOC Analysts.
• Coordinate technical containment, eradication, recovery, and post-incident monitoring activities with relevant stakeholders.
• Perform initial analysis and triage of malware, phishing emails, suspicious files, and exploit artifacts to identify malicious behavior and indicators of compromise.
• Analyze endpoint, network, and cloud security telemetry to identify attack patterns and potential threats.
• Identify opportunities to improve security monitoring and detection capabilities based on forensic investigations and incident findings.
• Develop and recommend detection logic, including Sigma rules, indicators, and detection use cases, for implementation by Cybersecurity Engineering teams.
• Prepare comprehensive technical investigation reports outlining incident timelines, findings, root causes, impact assessments, and recommended remediation actions.
• Communicate investigation progress, technical findings, and response recommendations to customers and internal stakeholders.
• Digital Forensics and Incident Investigation
• Maintain accurate chain-of-custody records and ensure forensic evidence is handled, documented, and preserved in accordance with established procedures.
• Perform forensic analysis of compromised systems to reconstruct attack timelines, identify indicators of compromise (IOCs), and determine attacker activities.
• Utilize forensic investigation tools and methodologies to support accurate and defensible technical findings.
• Incident Response and Threat Containment
• Investigate security incidents to determine attack vectors, affected systems, potential exposure, and appropriate remediation actions.
• Conduct compromise assessments to identify indicators of intrusion, unauthorized access, and other suspicious activities across customer environments.
• Support root cause analysis and post-incident reviews to identify security weaknesses and recommend corrective measures.
• Malware Analysis and Threat Investigation
• Investigate suspicious activities across Microsoft 365, Microsoft Entra ID, and other enterprise platforms.
• Collaborate with Cyber Threat Intelligence teams to incorporate relevant threat intelligence into investigations and response activities.
• Translate investigation findings into actionable recommendations to improve threat detection and response capabilities.
• Customer Engagement and Compliance
• Provide clear and actionable guidance to support customer remediation and security improvement activities.
• Provide technical evidence and investigation findings to the Line Manager to support regulatory notifications, compliance requirements, and formal investigations.
• Support applicable Saudi Arabian cybersecurity and data protection requirements, including those of the National Cybersecurity Authority (NCA), Saudi Central Bank (SAMA), and Personal Data Protection Law (PDPL), where relevant.
• Maintain accurate case documentation and ensure investigations are completed in accordance with established operational procedures and service requirements.
• Company Culture
• At ZainTECH, the culture emphasizes collaboration, innovation, and integrity. Employees are expected to uphold the company's Code of Conduct, which guides responsible behavior in interactions with colleagues, clients, and partners.