Digital Forensics & Incident Response (DFIR) Consultant

The Digital Forensics & Incident Response (DFIR) Consultant is responsible for investigating cybersecurity incidents, conducting digital forensic examinations, and supporting the containment, eradication, and recovery of security threats across customer environments. The role provides specialist technical expertise in incident investigation, evidence preservation, compromise assessments, and advanced threat analysis.

Requirements

Digital Forensics & Incident InvestigationConduct digital forensic investigations across endpoints, servers, networks, and cloud environments to identify evidence of malicious activity and security compromiseAcquire, preserve, and analyze digital evidence, including memory, system artifacts, and security logs, to determine incident scope, root cause, and potential impactMaintain accurate chain-of-custody records and ensure forensic evidence is handled, documented, and preserved in accordance with established proceduresPerform forensic analysis of compromised systems to reconstruct attack timelines, identify indicators of compromise (IOCs), and determine attacker activitiesUtilize forensic investigation tools and methodologies to support accurate and defensible technical findingsIncident Response & Threat ContainmentLead technical response activities for major security incidents escalated by Level 2 and Level 3 SOC AnalystsInvestigate security incidents to determine attack vectors, affected systems, potential exposure, and appropriate remediation actionsCoordinate technical containment, eradication, recovery, and post-incident monitoring activities with relevant stakeholdersConduct compromise assessments to identify indicators of intrusion, unauthorized access, and other suspicious activities across customer environmentsSupport root cause analysis and post-incident reviews to identify security weaknesses and recommend corrective measuresMalware Analysis & Threat InvestigationPerform initial analysis and triage of malware, phishing emails, suspicious files, and exploit artifacts to identify malicious behavior and indicators of compromiseAnalyze endpoint, network, and cloud security telemetry to identify attack patterns and potential threatsInvestigate suspicious activities across Microsoft 365, Microsoft Entra ID, and other enterprise platformsCollaborate with Cyber Threat Intelligence teams to incorporate relevant threat intelligence into investigations and response activitiesTranslate investigation findings into actionable recommendations to improve threat detection and response capabilitiesDetection Engineering & Security ImprovementIdentify opportunities to improve security monitoring and detection capabilities based on forensic investigations and incident findingsDevelop and recommend detection logic, including Sigma rules, indicators, and detection use cases, for implementation by Cybersecurity Engineering teamsContribute to the development and continuous improvement of incident response playbooks, forensic investigation procedures, and operational runbooksSupport the enhancement of Security Orchestration, Automation and Response (SOAR) workflows to improve incident handling efficiencyCollaborate with SOC and Engineering teams to strengthen incident detection, investigation, and response processesCustomer Engagement, Reporting & CompliancePrepare comprehensive technical investigation reports outlining incident timelines, findings, root causes, impact assessments, and recommended remediation actionsCommunicate investigation progress, technical findings, and response recommendations to customers and internal stakeholdersProvide clear and actionable guidance to support customer remediation and security improvement activitiesProvide technical evidence and investigation findings to the Line Manager to support regulatory notifications, compliance requirements, and formal investigationsSupport applicable Saudi Arabian cybersecurity and data protection requirements, including those of the National Cybersecurity Authority (NCA), Saudi Central Bank (SAMA), and Personal Data Protection Law (PDPL), where relevantMaintain accurate case documentation and ensure investigations are completed in accordance with established operational procedures and service requirementsOur Culture & Code of Conduct:At ZainTECH, we take pride in a culture built on collaboration, innovation, and uncompromising integrity. We are looking for individuals who share these values and are committed to customer-centricity and ethical excellence. All employees are expected to uphold our Code of Conduct, which serves as a guiding framework for responsible behavior across everything we do — from how we work with each other to how we engage with clients and partners globally.RequirementsMinimum 3 years of hands-on experience in digital forensics, incident response, cybersecurity investigations, or a related fieldPractical experience conducting forensic investigations and handling digital evidence using tools such as Velociraptor, KAPE, Volatility, and Endpoint Detection and Response (EDR) platformsStrong understanding of digital forensic methodologies, evidence acquisition, preservation, analysis, and chain-of-custody requirementsExperience analyzing endpoint, server, network, and cloud security logs to investigate security incidents and identify malicious activitiesHands-on knowledge of security investigations involving Microsoft 365 and Microsoft Entra IDWorking knowledge of Security Information and Event Management (SIEM) platforms and security monitoring technologiesExperience using Python or PowerShell for scripting, investigation support, and task automationUnderstanding of incident response methodologies, including identification, containment, eradication, recovery, and post-incident analysisStrong analytical, investigative, and problem-solving skills, with the ability to communicate technical findings effectivelyFluency in written and spoken EnglishBachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related fieldPreferred Certifications: GCFA, GCFE, GCIH, or GNFA. GCFR (SANS FOR509) for cloud forensics is a plus