Submit your application for GIAC-Certified Incident Response Lead (GCIA + GCIH / GCFA / GREM) | 10+ Years | Riyadh, Saudi Arabia | On-site

This role is open only to senior incident responders who hold active GIAC certifications and have 10 or more years of hands-on IR experience. Applications without the certifications listed below will not be considered. About us Reliable Company is a Saudi cybersecurity services provider based in Jeddah, delivering VAPT, security assessment, GRC and incident response services across the Kingdom. We are appointing a senior Incident Response Lead to head a high-priority engagement for a regulated enterprise client in Riyadh. The engagement responds to a software supply-chain compromise affecting source code repositories, CI/CD pipelines, developer endpoints and Google Cloud workloads. Mandatory certifications (active) • GIAC GCIA – Certified Intrusion Analyst • Plus at least one of: GIAC GCIH (Certified Incident Handler), GIAC GCFA (Certified Forensic Analyst) or GIAC GREM (Reverse Engineering Malware) • Holding GCIH, GCFA and GREM together is a strong advantage Mandatory experience • 10+ years of hands-on incident response and digital forensics • Has led IR engagements end to end as the named incident lead, not only as an analyst • Has handled software supply-chain, CI/CD or source-control (GitHub/GitLab) compromises, ideally with engagements we can reference What you will do • Lead containment, investigation and eradication end to end, as the named incident lead accountable to the client's leadership • Direct evidence preservation and chain of custody: repository mirrors, forensic triage of Windows and macOS endpoints, cloud workload evidence • Establish root cause, patient zero and the true infection window from audit logs and push telemetry • Hunt for attacker activity across DNS, NAT, proxy, firewall, EDR and cloud logs • Analyse obfuscated JavaScript loaders and build YARA and behavioural detections for known and variant samples • Plan and supervise eradication: device rebuilds, credential rotation sequencing, Git history clean-up and workload rebuilds • Write the investigation report, eradication plan and closure report to a standard regulators and auditors can rely on • Brief client stakeholders daily and support regulatory notification with accurate technical facts Technical depth we expect • Git internals: history analysis, unreachable objects, history rewriting (git filter-repo) • Cloud forensics, preferably Google Cloud and GKE; AWS/Azure also considered • JavaScript/Node.js malware deobfuscation and YARA authoring • EDR/XDR platforms and log analysis at scale (SIEM, BigQuery or similar) • Clear written English; Arabic is a plus Requirements • Based in Saudi Arabia, or able to relocate and work on-site in Riyadh at short notice • Willing to undergo background screening and sign confidentiality agreements • Available to start immediately or within a short notice period What we offer • Named lead role on a high-impact, technically demanding engagement • Competitive senior package based on certifications and experience • Long-term opportunity to build and lead Reliable Company's IR practice in KSA How to apply Send the following to hr@reliablecompany.sa with the subject "Incident Response Lead – Riyadh": 1. Your CV 2. GIAC certification names, numbers and expiry dates, or your GIAC verification/Credly links 3. A short summary of two or three IR engagements you led (type of incident, your role, outcome) You can also apply directly via LinkedIn. Shortlisted candidates will be contacted within a few days. #IncidentResponse #DFIR #GIAC #GCIA #GCIH #GCFA #GREM #CyberSecurity #SaudiArabia #Riyadh #Hiring #SupplyChainSecurity