About the Role
As a forensic investigator, you will own end-to-end forensic investigations across endpoints, cloud platforms, and network infrastructure. Your role will involve everything from initial triage to root cause analysis, which includes identifying Indicators of Compromise (IoC), data exfiltration, and unauthorized access. You will coordinate and lead the Digital Forensics and Incident Response (DFIR) team throughout active investigations, ensuring a consistent methodology, evidence integrity, and investigative velocity.
Ready to apply for roles like this?
Unlock the company name and direct application link. Subscribers get instant access to fresh jobs across Dubai, Abu Dhabi and Riyadh, many with visa support.
Unlock employer & apply directly
Responsibilities
- Pull and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct precise timelines of attack and user activity.
- Acquire forensic images from laptops, mobile devices, servers, and cloud repositories while maintaining a full chain of custody.
- Investigate artifacts—file systems, memory, registry, logs, and config states—to accurately reconstruct events and timelines.
- Correlate endpoint, network, and identity telemetry to create a coherent picture of attacker behavior and system access.
- Build AI-assisted workflows for automated evidence collection, pattern detection, and timeline generation, thereby scaling investigative capacity.
- Translate technical findings into clear, chronological narratives for executives and cross-functional stakeholders, ensuring clarity and avoiding jargon.
- Close the loop by feeding investigation outcomes back into detection rules, access controls, and policy improvements.
Requirements
🎓 Education
- Bachelor’s degree in Cybersecurity, International Relations, Computer Science, or a related field.
💼 Experience
- 5+ years of experience in digital forensics, incident response, or security investigations, with a strong track record leading or coordinating DFIR engagements.
- Exceptional written and verbal communication skills in both English and Arabic.
- Hands-on proficiency with forensic tools: FTK, X-Ways, Cellebrite, Axiom, or equivalent platforms.
- Strong command of network protocols (TCP/IP, HTTP/S, DNS) and experience with log analysis across SIEM platforms.
- Scripting proficiency in Python, PowerShell, or Bash, with practical use for automating evidence processing.
- Deep working knowledge of Windows, macOS, and Linux/Unix environments at the artifact and system level.
- Proven experience integrating AI tools into investigative workflows for triage, pattern detection, or reporting acceleration.
- Ability to communicate clearly and confidently, briefing executives and collaborating with legal, HR, and compliance teams while maintaining technical precision.
- Ensure all operations are compliant with NCA ECC and SAMA CSF regulations.
- Saudi nationality is required.
🏅 Certifications (Highly Preferred)
- SANS / GIAC (GCFA, GCFE, GNFA, GCIA or similar)
- IACIS CFCE
- EC-Council CHFI
- Offensive Security (OSDA, OSIR)
Benefits
🚀 Impact that Matters – Build products that shape the future of cybersecurity and protect organizations globally.
🏢 On-Site Collaboration – Work in our Almadina office, at the heart of innovation, alongside passionate experts.
💡 Continuous Growth – Gain access to certifications, trainings, and opportunities to enhance your expertise.
📈 Ownership Mindset – Participate in our Employee Stock Ownership Plan (ESOP) to grow along with the success of the organization.
🤝 Culture of Trust – We empower talent, encourage ownership, and celebrate real outcomes.
