DFIR Lead - Hays

About the Company

We’re partnering with a cybersecurity-focused organization seeking an experienced DFIR Lead to join their growing team. This role is well suited for senior DFIR professionals who perform well in high-pressure environments, lead complex investigations, and focus on the development and maturation of incident response capabilities. This is a fully remote, full-time opportunity for candidates who are legally authorized to work in Canada.

About the Role

As the DFIR Lead, you will serve as the primary escalation point for all digital forensics and incident response activities across the organization. You will oversee end-to-end investigations, lead post-breach remediation efforts, refine incident response methodologies, and support the ongoing development of internal IR processes. This is a hands-on technical leadership role requiring deep expertise across incident response, digital forensics, EDR, threat analysis, and security best practices. You will work closely with cross-functional teams including SOC, Sales, and external partners to ensure consistent execution and continuous improvement of DFIR capabilities.

Responsibilities

• Act as the central escalation point for all incident response activities, including triage, IOC identification, escalation, and post-incident actions
• Lead complex technical investigations involving packet captures, traffic analysis, and advanced troubleshooting
• Contribute to the development and enhancement of CERT and machine investigation lifecycles
• Develop, maintain, and document incident response methods, policies, procedures, and best-practice guidelines
• Create and maintain a detailed Incident Response runbook covering tools, forensic techniques, and investigative workflows
• Conduct live endpoint and offline forensic investigations, including evidence collection and remediation recommendations
• Implement and operationalize an incident response-focused ticketing system to improve tracking, reporting, and metrics
• Collaborate with third-party partners on investigations, business email compromise cases, post-breach remediation, and security improvements
• Produce incident response metrics and reporting
• Mentor team members on DFIR methodologies and forensic techniques
• Support Sales and SOC teams in transitioning IR, PBR, RMS, and eDiscovery engagements into long-term SOC services
• Develop and present technical investigation reports for clients and KPI dashboards for senior leadership
• Participate in a 24x7/365 incident response rotation for critical escalations and root-cause analysis

Qualifications

• 4–6+ years of hands-on incident response experience
• Hands-on experience responding to ransomware incidents and business email compromise (BEC) investigations
• Experience conducting incident response tabletop exercises
• Strong experience deploying and managing EDR technologies
• Knowledge of security frameworks, including NIST
• Proven experience developing and implementing IR methodologies and processes
• Hands-on experience with live endpoint investigations and forensic analysis across on-prem and cloud environments
• Strong familiarity with DFIR tools and investigative methodologies
• Broad technical knowledge across operating systems, virtualization, networking, firewalls, VPNs, SIEM, gateways, and related security technologies
• Experience mentoring team members or delivering internal training
• Ability to support operations across three regions as required
• Understanding of penetration testing fundamentals is an asset
• Bilingual (English/French) is considered a strong asset

Benefits (Canada)

• Paid Time Off
• Wellness Leave
• Birthday Day Off
• Health Benefits
• RRSP Program