Cyber Forensics & Incident Recovery Associate

Forensic Focus Limited; Toronto; On-site; CAD 85,000 - 110,000; Full time

Job summary

Forensic Focus Limited is seeking a technically grounded practitioner to join its forensic services practice in Toronto. The role involves collecting and analyzing digital evidence across Windows, Linux, virtualised, and cloud environments, while leading containment and eradication during active ransomware engagements.

The candidate will support enterprise recovery and communicate findings to legal counsel, adapting to both deep analysis and clear, non-technical briefing.

Qualifications

• Hands-on experience with modern EDR platforms and forensic workflows.
• Proficiency with virtualization and cloud environments and imaging methods.
• Certifications in digital forensics or incident response are advantageous.

Responsibilities

• Collect and analyse digital evidence across Windows, Linux, and cloud environments.
• Lead incident containment and eradication during active engagements.
• Support enterprise infrastructure recovery in ransomware scenarios.
• Present findings clearly to legal counsel and non-technical stakeholders.

Tools

CrowdStrike Falcon

VMware

Hyper-V

Azure

Microsoft 365

Forensic imaging

Domain controller rebuilds

Job description

Forensic Focus Limited is seeking a technically grounded practitioner to join its forensic services practice in Toronto. The role involves collecting and analyzing digital evidence across Windows, Linux, virtualised, and cloud environments, while leading containment and eradication during active ransomware engagements.

The candidate will support enterprise recovery and communicate findings to legal counsel, adapting to both deep analysis and clear, non-technical briefing.