isacybersecurity

isacybersecurity

Incident Response Analyst, Digital Forensics & Incident Response

Toronto, Ontario

No sponsorshipDetected 3 hours ago
AWSGCPAzureCloud PlatformsLinuxCybersecuritySIEMSOARIncident ResponseAccessibilityHRLeadershipCommunicationCISSPCompTIA

About the role

  • The Incident Response (IR) Analyst is a hands-on technical responder within ISA Cybersecurity's Digital Forensics & Incident Response (DFIR) function, delivering the Security Incident Response (SIR) service across client engagements.
  • Strategic direction rests with the Incident Commander and final accountability for the DFIR program rests with the Senior Director, DFIR Services.

Responsibilities

  • Support the Incident Commander in the execution of IR Retainer engagements and Emergency IRs, carrying out assigned workstreams within the incident.
  • Perform digital forensic acquisition and analysis across endpoint, server, network, mobile, and cloud sources.
  • Maintain chain-of-custody discipline suitable for legal proceedings throughout evidence handling.
  • Reconstruct attack timelines from collected evidence to support root-cause analysis and scope determination.
  • Support the IR readiness program, including IR Plan engagements, Tabletop Exercises (TTX), and playbook validation.
  • Collaborate with SOC analysts and Service Owners to keep incident response work aligned with detection capabilities.
  • At ISA Cybersecurity we lead with our "Why".
  • We are proud to offer a variety of employee friendly programs that enable our team to perform at their best.

Requirements

  • 3+ years of progressive experience in cybersecurity, including direct experience in incident response and/or digital forensics.
  • Working knowledge of the incident response lifecycle, containment and eradication strategies, and digital forensic methodologies.
  • Hands-on experience with host, network, or cloud forensics, including exposure to chain-of-custody requirements.
  • Working knowledge of security control families such as EDR, SIEM, SOAR, NDR, identity, email security, or DLP.
  • Familiarity with MITRE ATT&CK and current ransomware/APT TTPs.
  • Familiarity with frameworks such as NIST SP 800-61, ISO 27035, or NIST CSF is an asset.
  • Bachelor's degree in computer science, Information Security, or related field, or equivalent professional experience.
  • Ability to obtain Government of Canada security clearance.
  • Proficient working with Windows, Linux, and MacOS environments.
  • Exposure to cloud forensics or investigations (AWS, Azure, GCP, Microsoft 365, Google Workspace).
  • Clear written and verbal communication skills
  • ability to document technical findings for both technical and non-technical audiences.
  • Willingness to participate in 24x7 on-call rotation for IR Retainers and Emergency IRs.
  • Strong English language skills, written and verbal.

Nice to have

  • Experience supporting MSSP service delivery, including contractual SLAs and 24x7 operations.
  • Experience supporting law enforcement engagements or regulatory investigations.
  • Exposure to dark web or social-media threat monitoring.
  • Multilingual capability is an asset.
  • Preferred: GCIH, GCFA, GCFE
  • Nice to have: OSCP, CySA+, CHFI, ECIH, CompTIA Security+, CISSP (or actively pursuing)
  • Cloud (any of): AWS Security Specialty, Azure Security Engineer, Google Professional Cloud Security Engineer
  • Our Why is to make people feel safe.

Compensation

  • $75,000-90,000-105,000 AI Disclosure: ISA Cybersecurity does not currently use artificial intelligence tools as part of our recruitment process.

Benefits

  • Flexible sick and personal days for all employees
  • Generous health plan with enhanced mental health resources and programs
  • Professional development opportunities and education reimbursement up to $2,000 annually for all employees

Company info

  • We are proud to be recognized as a top employer for multiple years in a row, we currently hold the distinctions of Canada's Top Small and Medium Employers 2025, Greater Toronto's Top Employers 2025 and are Certified Great Place to Work 2026-2027.
  • ISA Cybersecurity is a proudly Canadian cyber and AI services and solutions provider. Trusted by over 500 clients from SMB to global enterprise, we empower organizations to safeguard their most critical assets and adopt AI securely. Through our highly customizable Cyber 360 and AI 360 offerings, we deliver a comprehensive range of governance, assurance, engineering protection, detection, and response services for the public and private sectors. Backed by over three decades of operational experience and a vast network of highly specialized and certified experts, we leverage cutting-edge technologies and AI to ensure that clients achieve their privacy, security, and business goals.
  • We operate in a remote-first environment. Office presence is typically less than 20% of the time, varying by role and work requirements. Our office space, located at Bloor and Islington, is a collaborative space designed for in-person meetings and drop-ins. We enjoy hosting in-person quarterly townhalls and social events throughout the year to encourage teambuilding and collaboration.
  • ISA Cybersecurity is a proudly Canadian cyber and AI services and solutions provider.
  • Trusted by over 500 clients from SMB to global enterprise, we empower organizations to safeguard their most critical assets and adopt AI securely.
  • Through our highly customizable Cyber 360 and AI 360 offerings, we deliver a comprehensive range of governance, assurance, engineering protection, detection, and response services for the public and private sectors.
  • Backed by over three decades of operational experience and a vast network of highly specialized and certified experts, we leverage cutting-edge technologies and AI to ensure that clients achieve their privacy, security, and business goals.
  • We operate in a remote-first environment.
  • Office presence is typically less than 20% of the time, varying by role and work requirements.
  • Our office space, located at Bloor and Islington, is a collaborative space designed for in-person meetings and drop-ins.
  • We enjoy hosting in-person quarterly townhalls and social events throughout the year to encourage teambuilding and collaboration.

Visa & Work Authorization

  • Ability to obtain Government of Canada security clearance
Apply directly at isacybersecurity →Create a free account for alerts like thisView isacybersecurity immigration profile

This listing is sourced directly from isacybersecurity's careers page and normalized into a canonical job model.