Riyadh Customer Success & Professional Services Senior DFIR Consultant

← Back to all vacancies Riyadh Customer Success & Professional Services

Founded in 2003 and headquartered in Singapore, Group-IB is a leading creator of cybersecurity technologies to investigate, prevent, and fight digital crime. Combating cybercrime is in the company’s DNA, shaping its technological capabilities to defend businesses, citizens, and support law enforcement operations.

Group-IB’s Digital Crime Resistance Centers (DCRCs) are located in the Middle East, Europe, Central Asia, and Asia-Pacific to help critically analyze and promptly mitigate regional and country-specific threats. These mission-critical units help Group-IB strengthen its contribution to global cybercrime prevention and continually expand its threat-hunting capabilities.

The Senior DFIR Specialist leads complex cybersecurity investigations from first call to final report. Reporting to the Regional Head, you will be the first technical escalation point on your shift, direct other responders during an incident, and review their work before it reaches the client.

This is a hands-on technical role. It does not include people management or setting the strategy of the DFIR team.

The DFIR vision:
Our goal is to fight cybercrime by constantly learning and staying one step ahead of the attackers. We do not just solve isolated puzzles; we bring different security experts together to build a complete and strong defense. By handling a large volume of cases, we gain real, practical experience that makes us better every day. Instead of handing our clients a confusing list of technical data or “homework,” we give clear, actionable answers that explain what happened and what it means for their business.

We keep researching and looking ahead so we are ready for the future of automated cyber threats.

DFIR duties (24/7 service)

• Provide continuous 24/7 service on a shared rotation, including weekends..
• Travel onsite to support clients during critical incidents..
• Investigate hands-on across Windows, Linux and memory forensics.

Incident leadership

• Lead investigations end to end: scoping, triage, evidence collection, analysis, containment advice and reporting..
• Act as the first escalation point for the team and for clients on your shift..
• Make sound calls with incomplete data, balancing depth of analysis against speed of response..
• Brief client technical teams and executives in clear, non-technical language.

Quality and reporting

• Write and own final investigation reports that clients, insurers and regulators rely on..
• Review the reports and findings of colleagues before delivery..
• Turn case lessons into playbooks, detection ideas and internal knowledge..

Team growth

• Mentor Middle and Junior specialists on live cases.
• Share knowledge through internal trainings, write‑ups, blog posts or conference talks.
• Help improve tooling and automation of the investigative workflow.

• Minimum of 5 years in DFIR or incident response roles, with cases you led yourself.
• Strong hands‑on Windows, Linux and memory forensics.
• Experience with ransomware and targeted intrusion cases, including timeline building and root‑cause analysis.
• Clear technical writing.
• High-level decision-making skills in dynamic and high‑pressure environments..
• Fluent English

• Deep expertise in one area: cloud forensics (AWS/Azure/M365/GCP), network forensics, or OT/ICS..
• Certifications such as GCFA, GCFR, GREM, GNFA, GCIH or equivalent practical labs
• Public research, tools, talks or articles

Group-IB is a global leader in cybersecurity technologies that investigate, predict, prevent, and fight digital crime. We help organizations reduce risk and protect trust. Trusted by…