Cybersecurity Incident Response Commander
$135,000–$180,000 year
HybridToronto, Ontario, Canada
Job Summary
Command all IR Retainer and Emergency engagements as the technical authority for Digital Forensics & Incident Response, leading investigations across endpoint, server, network, mobile, and cloud sources while maintaining strict chain-of-custody discipline. Refine DFIR playbooks, runbooks, and detection content by integrating threat intelligence and feeding TTPs back into hunting hypotheses. Serve as the senior client-facing voice, briefing executives, boards, regulators, and law enforcement, and present evidence reports that translate lessons learned into process improvements. Lead the IR readiness program through tabletop exercises, plan engagements, and analyst coaching, while supporting presales activities and representing ISA externally as a recognized subject-matter expert. Participate in 24x7 on-call rotation for retainers and emergency response.
Required Qualifications
- 10+ years of progressive experience in cybersecurity
- at least 7 years in incident response and digital forensics roles
- Demonstrated experience as Incident Commander on multiple high-severity engagements (e.g., ransomware, BEC, APT intrusion, large-scale data breach)
- Expert-level knowledge of the incident response lifecycle, containment and eradication strategies, and digital forensic methodologies
- Hands-on expertise across host, network, memory, mobile, and cloud forensics, including chain-of-custody discipline suitable for legal proceedings
- Proficient working with Windows, Linux, and MacOS
- Experience with multi-cloud forensics (AWS, Azure, GCP, Microsoft 365, Google Workspace) and SaaS-platform investigations
- Experience with OSINT (Open-Source Intelligence), including gathering and correlating publicly available information to support threat actor attribution, infrastructure mapping, and exposure analysis, and translating findings into actionable intelligence for client engagements
- Working knowledge of multiple security control families such as EDR, SIEM, SOAR, NDR, identity, email security, DLP, and their use during response
- Deep familiarity with MITRE ATT&CK and current ransomware/APT TTPs
- Working knowledge of NIST SP 800-61, ISO 27035, ISO 27001:2022, NIST CSF, SOC 2, and CSA CCM
- Demonstrated ability to identify, define, track, and report on operational and service-quality metrics, and to run continuous-improvement cycles against them
- Excellent leadership-by-influence, executive communication, and stakeholder management skills; must be able to communicate clearly under pressure and to non-technical audiences
- Trusted advisor presence; ability to brief client executives and boards on cyber risk, governance, and resilience between as well as during incidents
- Bachelor's degree in computer science, Information Security, or related field, or equivalent professional experience
- CISSP (required)
- Willingness to participate in 24x7 on-call rotation for IR Retainers and Emergency IRs
- Ability to obtain Government of Canada security clearance
- Strong English language skills, written and verbal
Desired Qualifications
- People leadership experience including coaching, mentoring, performance feedback, hiring panels, even where the role has not formally carried direct reports
- Experience leading or contributing to MSSP service delivery including contractual SLAs, RACI models, 24x7 operations, and onboarding/transition workflows
- Recognized externally as a subject matter expert through published research, conference talks, MITRE ATT&CK contributions, media commentary, or industry awards
- Experience supporting law enforcement engagements (RCMP NC3, CCCS/CCIRC, FBI Cyber), Anton Piller orders, expert witness testimony, or regulatory investigations
- Experience with dark web monitoring and social-media threat monitoring
- Multilingual capability is an asset
- GCIH, GCFA, GCIA, GX-FA, GSE
- OSCP, CISM, CCSP, EnCE, CHFI, ECIH
- AWS Security Specialty, Azure Security Engineer, Google Professional Cloud Security Engineer
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.