Consulting Associate/Recovery Services (Forensic Services practice)

Forensic Focus Limited; Toronto; On-site; CAD 85,000 - 110,000; Full time

Job summary

Forensic Focus Limited is seeking a technically grounded practitioner to join its forensic services practice in Toronto. The role involves collecting and analyzing digital evidence across Windows, Linux, virtualised, and cloud environments, while leading containment and eradication during active ransomware engagements.

The candidate will support enterprise recovery and communicate findings to legal counsel, adapting to both deep analysis and clear, non-technical briefing.

Qualifications

• Hands-on experience with modern EDR platforms and forensic workflows.
• Proficiency with virtualization and cloud environments and imaging methods.
• Certifications in digital forensics or incident response are advantageous.

Responsibilities

• Collect and analyse digital evidence across Windows, Linux, and cloud environments.
• Lead incident containment and eradication during active engagements.
• Support enterprise infrastructure recovery in ransomware scenarios.
• Present findings clearly to legal counsel and non-technical stakeholders.

Tools

CrowdStrike Falcon

VMware

Hyper-V

Azure

Microsoft 365

Forensic imaging

Domain controller rebuilds

Job description

The Role

This position sits within a forensic services practice focused on fraud, misconduct, and cybercrime investigations. Day to day, practitioners collect and analyse digital evidence across Windows, Linux, virtualised, and cloud environments, lead incident containment and eradication, and support enterprise infrastructure recovery during active ransomware engagements.

Skills & Experience

Candidates should have hands-on experience with EDR platforms such as CrowdStrike Falcon, virtualisation technologies including VMware and Hyper-V, and cloud environments such as Azure and Microsoft 365. Familiarity with domain controller rebuilds and forensic imaging methodologies is essential. Relevant certifications in digital forensics or incident response are advantageous.

Who It Suits

This role suits a technically grounded practitioner who thrives under pressure and moves comfortably between deep forensic analysis and clear communication with legal counsel. Someone equally confident working overnight on a compromised host and presenting findings to a non-technical audience the following morning will excel here.