Staff DFIR - COGNNA
Job Fit Check
Base Career helps you apply smarter for this job.
Key skills for this role
About the Role
COGNNA is seeking a Staff DFIR to lead end-to-end forensic investigations across endpoints, cloud, and network infrastructure. The role requires 5+ years in digital forensics and incident response, hands-on proficiency with forensic tooling, and scripting ability in Python, PowerShell, or Bash.
Key Skills for This Role
Responsibilities
- Own end to end forensic investigations across endpoints, cloud platforms, and network infrastructure
- Coordinate and lead the DFIR team across active investigations
- Pull and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms
- Acquire forensic images from laptops, mobile devices, servers, and cloud repositories with full chain of custody
- Analyze artifacts including file systems, memory, registry, logs, and config states
- Correlate endpoint, network, and identity telemetry into a coherent picture of attacker behavior
- Build AI assisted workflows that automate evidence collection, pattern detection, and timeline generation
- Translate technical findings into clear, chronological narratives for executives and cross functional stakeholders
- Feed investigation outcomes back into detection rules, access controls, and policy improvements
Requirements
- Bachelor's in Cybersecurity, International Relations, Computer Science, or related field
- 5+ years in digital forensics, incident response, or security investigations
- Exceptional written and verbal communication in both English & Arabic
- Hands on proficiency with forensic tooling: FTK, X Ways, Cellebrite, Axiom, or equivalent
- Strong command of network protocols (TCP/IP, HTTP/S, DNS) and log analysis across SIEM platforms
- Scripting ability in Python, PowerShell, or Bash
- Deep working knowledge of Windows, macOS, and Linux/Unix environments
- Proven experience integrating AI tools into investigative workflows
- Previous leadership experience
- Compliance with NCA ECC and SAMA CSF regulations
Full Job Posting
Who We Are
- COGNNA is shaping the future of cybersecurity through innovation, intelligence, and a relentless drive to protect.
- Our platforms integrate cutting edge AI, real time threat detection, and deep security insights.
Responsibilities
- Own end to end forensic investigations across endpoints, cloud platforms, and network infrastructure — from initial triage to root cause, including IoC identification, data exfiltration, and unauthorized access.
- Coordinate and lead the DFIR team across active investigations, ensuring consistent methodology, evidence integrity, and investigative velocity.
- Pull and analyze logs from EDR/XDR, SIEM, DLP, IdP, and email gateway platforms to reconstruct precise attack and user activity timelines.
- Acquire forensic images from laptops, mobile devices, servers, and cloud repositories with full chain of custody.
- Go deep on artifacts — file systems, memory, registry, logs, config states — to reconstruct exactly what happened and when.
- Correlate endpoint, network, and identity telemetry into a coherent picture of attacker behavior and system access.
- Build AI assisted workflows that automate evidence collection, pattern detection, and timeline generation to scale investigative capacity.
- Translate technical findings into clear, chronological narratives for executives and cross functional stakeholders — no jargon, no ambiguity.
- Close the loop: feed investigation outcomes back into detection rules, access controls, and policy improvements.
Requirements
- Bachelor's in Cybersecurity, International Relations, Computer Science, or related field.
- 5+ years in digital forensics, incident response, or security investigations, with a track record leading or coordinating DFIR engagements.
- Exceptional written and verbal communication in both English & Arabic.
- Hands on proficiency with forensic tooling: FTK, X Ways, Cellebrite, Axiom, or equivalent platforms.
- Strong command of network protocols (TCP/IP, HTTP/S, DNS) and log analysis across SIEM platforms.
- Scripting ability in Python, PowerShell, or Bash — used to automate evidence processing, not just theoretically.
- Deep working knowledge of Windows, macOS, and Linux/Unix environments at the artifact and system level.
- Proven experience integrating AI tools into investigative workflows to accelerate triage, pattern detection, or reporting.
- Clear, confident communicator — able to brief executives and work alongside legal, HR, and compliance teams without losing technical precision.
- Compliance: Ensuring all operations align with NCA ECC and SAMA CSF regulations.
- Previous leadership experience is a must.
Certifications (Highly Preferred)
- SANS / GIAC (GCFA, GCFE, GNFA, GCIA or similar)
- IACIS CFCE
- EC Council CHFI
- Offsec (OSDA, OSIR)
Soft Skills
- Exceptional analytical thinking and creative problem solving.
- Excellent communication (English & Arabic), including technical reporting.
- Strong mentorship abilities and a collaborative spirit.
- Self motivated, focused, and passionate about cyber defense.
- Capable of juggling priorities under high pressure situations.
Benefits
- Impact that Matters: Build products that shape the future of cybersecurity and protect organizations globally.
- On Site Collaboration: Be at the heart of innovation in our Riyadh office, working side by side with passionate experts.
- Continuous Growth: Access to certifications, trainings, and opportunities to sharpen your expertise.
- Ownership Mindset: Benefit from our ESOP program and grow with COGNNA's success.
- Culture of Trust: We empower talent, encourage ownership, and celebrate real outcomes.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at COGNNA
Staff DFIR
Riyadh, KSA
Conduct end-to-end forensic investigations, lead DFIR teams, analyze logs, and automate workflows while ensuring compliance and effective communication.
Senior DFIR Guardian
Riyadh, KSA
Conduct end-to-end forensic investigations, analyze logs, automate evidence collection, and ensure compliance with cybersecurity regulations while communicating effectively in E...
Staff DFIR - COGNNA
الرياض, KSA
COGNNA is seeking a Staff DFIR professional to lead forensic investigations and incident response. The role involves end-to-end investigations across endpoints, cloud, and network, coordinating the DFIR team, and buildin
Senior DFIR Guardian - COGNNA
الرياض, KSA
COGNNA is hiring a Senior DFIR Guardian to lead forensic investigations and incident response. The role involves end-to-end investigations, coordinating the DFIR team, and building AI-assisted workflows. Candidates need
Threat Detection - COOP
Riyadh, KSA
As a Threat Detection COOP at COGNNA, you ll design high-impact detection strategies, build powerful automation, and elevate SOC operations to a world-class standard. You ll als...
Threat Detection - COOP
Riyadh, KSA
COGNNA is offering a 6-month co-op for a Threat Detection COOP in Riyadh. You will design detection strategies, build automation, and support SOC operations while mentoring rising talent. Requires enrollment in a Bachelo
Threat Detection Engineer
Riyadh, KSA
As a Threat Detection Engineer at COGNNA, you ll design high-impact detection strategies, build powerful automation, and elevate SOC operations to a world-class standard. You ll...
Threat Detection - COOP
الرياض, KSA
COGNNA seeks a Threat Detection COOP intern to design detection strategies, build automation, and support SOC operations. The role requires enrollment in a Bachelor's degree in Computer Science or related field, basic cy
Staff DFIR
Riyadh, KSA
Senior DFIR Guardian
Riyadh, KSA
Staff DFIR - COGNNA
الرياض, KSA
Senior DFIR Guardian - COGNNA
الرياض, KSA
Threat Detection - COOP
Riyadh, KSA
Threat Detection - COOP
Riyadh, KSA
Threat Detection Engineer
Riyadh, KSA
Threat Detection - COOP
الرياض, KSA