Cybersecurity Defense DFIR

Job purpose

Responsible for identifying, investigating, and responding to cyber incidents across the organization. This role combines advanced digital forensics, threat analysis, and incident response activities to rapidly contain threats, determine root cause, and support recovery efforts. The DFIR Specialist works closely with SOC and threat intelligence teams to strengthen the organization’s security posture and resilience.

• Lead or support the full lifecycle of incident response, including identification, containment, eradication, and recovery.
• Perform rapid triage and analysis of security alerts, logs, network traffic, and endpoint telemetry.
• Document incident timelines, technical findings, and recommendations for stakeholders.
• Conduct forensic acquisition and analysis of endpoints, servers, cloud systems, and mobile devices.
• Perform disk, memory, and malware analysis to determine attacker activity, persistence mechanisms, and impact.
• Preserve and maintain chain-of-custody for digital evidence.
• Provide feedback to SOC and detection engineering teams to improve alerting, detection rules, and playbooks.

• Bachelor’s degree in computer science, Information Technology, Telecommunications, Electronics & Electrical or any related field.
• 3+ years of experience in cybersecurity operations (SOC, DFIR, cyber defense, or related roles).
• CompTIA Security+
• GCIH
• GCFE
• GCFA
• In-depth knowledge of security concepts such as cyber-attacks and techniques, threat vectors, incident management etc.
• In-depth knowledge of best practice security frameworks such as NIST, SAMA CSF, OWASP, ISO 27001 and PCI-DSS.

• Cybersecurity Incident Response
• Security Information and Event Management (SIEM)
• EDR, IDS/IPS, DLP and SOAR
• Cloud Security (AWS/OCI/GCP/Azure)
• Email Security
• Packet analysis
• Good understanding of IS security controls, monitoring systems and business drivers that impact security policy and practice