The Digital Forensics & Incident Response (DFIR) Consultant is responsible for investigating cybersecurity incidents, conducting digital forensic examinations, and supporting the containment, eradication, and recovery of security threats across customer environments. The role provides specialist technical expertise in incident investigation, evidence preservation, compromise assessments, and advanced threat analysis.

Requirements:

Digital Forensics & Incident Investigation

• Conduct digital forensic investigations across endpoints, servers, networks, and cloud environments to identify evidence of malicious activity and security compromise.
• Acquire, preserve, and analyze digital evidence, including memory, system artifacts, and security logs, to determine incident scope, root cause, and potential impact.
• Maintain accurate chain-of-custody records and ensure forensic evidence is handled, documented, and preserved in accordance with established procedures.
• Perform forensic analysis of compromised systems to reconstruct attack timelines, identify indicators of compromise (IOCs), and determine attacker activities.
• Utilize forensic investigation tools and methodologies to support accurate and defensible technical findings.

Incident Response & Threat Containment

• Lead technical response activities for major security incidents escalated by Level 2 and Level 3 SOC Analysts.
• Investigate security incidents to determine attack vectors, affected systems, potential exposure, and appropriate remediation actions.
• Coordinate technical containment, eradication, recovery, and post-incident monitoring activities with relevant stakeholders.
• Conduct compromise assessments to identify indicators of intrusion, unauthorized access, and other suspicious activities across customer environments.
• Support root cause analysis and post-incident reviews to identify security weaknesses and recommend corrective measures.

Malware Analysis & Threat Investigation

• Perform initial analysis and triage of malware, phishing emails, suspicious files, and exploit artifacts to identify malicious behavior and indicators of compromise.
• Analyze endpoint, network, and cloud security telemetry to identify attack patterns and potential threats.
• Investigate suspicious activities across Microsoft 365, Microsoft Entra ID, and other enterprise platforms.
• Collaborate with Cyber Threat Intelligence teams to incorporate relevant threat intelligence into investigations and response activities.
• Translate investigation findings into actionable recommendations to improve threat detection and response capabilities.

Detection Engineering & Security Improvement

• Identify opportunities to improve security monitoring and detection capabilities based on forensic investigations and incident findings.
• Develop and recommend detection logic, including Sigma rules, indicators, and detection use cases, for implementation by Cybersecurity Engineering teams.
• Contribute to the development and continuous improvement of incident response playbooks, forensic investigation procedures, and operational runbooks.
• Support the enhancement of Security Orchestration, Automation and Response (SOAR) workflows to improve incident handling efficiency.
• Collaborate with SOC and Engineering teams to strengthen incident detection, investigation, and response processes.

Customer Engagement, Reporting & Compliance

• Prepare comprehensive technical investigation reports outlining incident timelines, findings, root causes, impact assessments, and recommended remediation actions.
• Communicate investigation progress, technical findings, and response recommendations to customers and internal stakeholders.
• Provide clear and actionable guidance to support customer remediation and security improvement activities.
• Provide technical evidence and investigation findings to the Line Manager to support regulatory notifications, compliance requirements, and formal investigations.
• Support applicable Saudi Arabian cybersecurity and data protection requirements, including those of the National Cybersecurity Authority (NCA), Saudi Central Bank (SAMA), and Personal Data Protection Law (PDPL), where relevant.
• Maintain accurate case documentation and ensure investigations are completed in accordance with established operational procedures and service requirements.

Our Culture & Code of Conduct:

At ZainTECH, we take pride in a culture built on collaboration, innovation, and uncompromising integrity. We are looking for individuals who share these values and are committed to customer-centricity and ethical excellence. All employees are expected to uphold our Code of Conduct, which serves as a guiding framework for responsible behavior across everything we do — from how we work with each other to how we engage with clients and partners globally.

Requirements

• Minimum 3 years of hands-on experience in digital forensics, incident response, cybersecurity investigations, or a related field.
• Practical experience conducting forensic investigations and handling digital evidence using tools such as Velociraptor, KAPE, Volatility, and Endpoint Detection and Response (EDR) platforms.
• Strong understanding of digital forensic methodologies, evidence acquisition, preservation, analysis, and chain-of-custody requirements.
• Experience analyzing endpoint, server, network, and cloud security logs to investigate security incidents and identify malicious activities.
• Hands-on knowledge of security investigations involving Microsoft 365 and Microsoft Entra ID.
• Working knowledge of Security Information and Event Management (SIEM) platforms and security monitoring technologies.
• Experience using Python or PowerShell for scripting, investigation support, and task automation.
• Understanding of incident response methodologies, including identification, containment, eradication, recovery, and post-incident analysis.
• Strong analytical, investigative, and problem-solving skills, with the ability to communicate technical findings effectively.
• Fluency in written and spoken English.

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field.
• Preferred Certifications: GCFA, GCFE, GCIH, or GNFA. GCFR (SANS FOR509) for cloud forensics is a plus.