Cybersecurity Incident Investigator

Kyndryl Inc.; Montreal; Remote; CAD 119,000 - 169,000; Full time

Job summary

Kyndryl Inc. is seeking a Cybersecurity Incident Investigator to lead end-to-end investigations across cloud, identity, and hybrid environments in a flexible remote Canada-wide model.

You will piece together attack timelines from forensic evidence, assess business risk and regulatory implications, and deliver defensible root-cause determinations to leadership. If you are passionate about digital forensics, solving puzzles, and collaborating with cross-functional teams, this is a great

Qualifications

• Government of Canada Security Clearance (Level 2 - Secret / Protected B) required or eligible.
• Authorized to work in Canada.
• End-to-end cybersecurity IR and digital forensics experience.
• Experience with identity and access architectures (Azure AD, Active Directory).
• Experience analyzing SIEM telemetry, forensic artifacts, network data, and OS internals in Windows and Linux.
• Ability to establish defensible sequence-of-events timelines and root-cause determinations.
• Experience communicating findings with executives and non-technical stakeholders.
• Ability to work autonomously in a remote, distributed team across Canadian time zones.

Responsibilities

• Conduct end-to-end cybersecurity investigations across cloud, identity, and hybrid systems.
• Determine root cause and initial access vectors; assess business risk and regulatory impact.
• Deliver defensible attack timelines and recommendations to leadership.
• Examine evidence from forensic artifacts and SIEM to piece together incident timelines.
• Collaborate with cross-functional teams and regulatory stakeholders to uphold resilience and compliance.

Skills

Microsoft Entra ID

Active Directory

Hybrid cloud security

SIEM telemetry

Windows internals

Linux internals

Incident response

Forensics

Executive reporting

Remote work

Tools

Velociraptor

FTK

EnCase

Volatility

KAPE

Job description

Who We Are

At Kyndryl, we run and reimagine the mission-critical technology systems that drive advantage for the world’s leading businesses. We are at the heart of progress; with proven expertise and a continuous flow of AI-powered insight, enabling smarter decisions, faster innovation, and a lasting competitive edge. For our people—Kyndryls—that means doing purposeful work that powers human progress. Join us and experience a flexible, supportive environment where your well-being is prioritized and your potential can thrive.

The Role

In CIO Incident Response & Forensics at Kyndryl, you will be critical in investigating and safeguarding our mission-critical enterprise environments. Your role will be to conduct deep-dive, end-to-end cybersecurity investigations—specifically across high-stakes cloud, identity, and hybrid systems—ensuring complex security events are thoroughly investigated, contained, and resolved. Unlike a traditional security operations role focused on alert triage, you will lead comprehensive investigations into advanced threats, including malware and ransomware, credential theft, business email compromise (BEC), insider threats, and potential data exposure. Operating from anywhere in Canada in a flexible remote model, you will examine evidence across multiple platforms, determine root cause and initial access vectors, assess business and compliance risks, and provide actionable recommendations to leadership. Your investigative prowess will be put to the test piecing together attack timelines from raw technical evidence, evaluating impact beyond technical alerts, and delivering defensible root-cause determinations to keep our environments resilient, secure, and compliant. At Kyndryl, we are committed to operational excellence and protecting vital digital assets. As a Cybersecurity Incident Investigator, you will be an integral part of that mission. If you are passionate about digital forensics, solving complex security puzzles, and want to be part of a collaborative team defending critical infrastructure—then this role is for you.

Your Future at Kyndryl

Kyndryl's focus on innovative IT and security solutions means that in CIO Incident Response & Forensics, you will work with modern threat detection and forensic technologies while enjoying clear paths to grow your skills. You will collaborate with cross-functional technical teams, executive leaders, and regulatory stakeholders across Canada to lead high-visibility investigations and uphold the highest standards of operational resilience.

Who You Are

You are good at what you do and possess the required investigative experience to prove it. Equally important, you bring a curious mindset, dedication to digital integrity, and strong communication skills to articulate technical findings to both technical peers and business leadership.

Required Skills and Experience

• Must hold, or be strictly eligible to obtain and maintain, a Government of Canada Security Clearance (Level 2 - Secret / Protected B).
• Must be legally authorized to work in Canada.
• Proven track record and hands-on experience in cybersecurity incident response (IR), digital forensics, or complex security investigations (end-to-end investigation, not basic alert triage).
• Strong technical expertise with identity and access architectures, specifically Microsoft Entra ID (Azure AD), Active Directory, and hybrid cloud security.
• Solid investigative foundation analyzing SIEM telemetry, forensic artifacts, network data, and operating system internals across both Windows and Linux.
• Proven ability to establish defensible sequence-of-events attack timelines, initial access vectors, and root-cause determinations.
• Strong experience assessing business risk, regulatory implications, and confidentiality impact alongside pure technical severity.
• Demonstrated capability to produce clear, executive-ready investigation reports and brief non-technical stakeholders during high-severity events.
• Ability to work effectively and autonomously in a remote, distributed team across Canadian time zones.

Preferred Skills and Experience

• Relevant industry certifications (e.g., GIAC GCFE, GCFA, GCIH, GNFA, or CISSP).
• Hands-on experience with enterprise forensic tooling (e.g., Velociraptor, FTK, EnCase, Volatility, KAPE) and modern EDR/XDR platforms.
• Practical understanding of threat intelligence and mapping attacker behaviors via frameworks like MITRE ATT&CK.

Salary

Salary: $118,700 - $168,700 CAD The above represents Kyndryl’s pay range for this role. Salaries will vary based on factors such as location, skills, experience, education, and qualifications for the role. The range provided reflects the target compensation range for the position at the time of posting. Kyndryl’s total compensation package will vary based on the pay type of the position and may include performance-based incentives, discretionary bonuses, as well as other perks and rewards. This position requires the employee to work on a regular basis with Kyndryl stakeholders located in other Canadian provinces, the United States, or internationally where English is the common language, making knowledge of the English language a requirement for this position in addition to fluency in French.

Being You

The "Kyn" in Kyndryl means kinship, which represents the strong bonds we have with each other, our customers and our communities. We focus on ensuring all Kyndryls feel included and we welcome people of all cultures, backgrounds, and experiences. Even if you don’t meet every requirement, we encourage you to apply. We believe in growth, and we’re excited to see what you can bring. At Kyndryl, employee feedback has told us that our number one driver of employee engagement is belonging. That sense of belonging - being a valued, respected, trusted member of the team - is fundamental to our culture and fueling great experiences for our customers. This dedication to welcoming everyone into our company means that Kyndryl gives you the ability to thrive and contribute to our culture of empathy and shared success. That’s The Kyndryl Way.

What You Can Expect

Your career with us isn’t just a job—it’s an adventure with purpose. We offer a dynamic, hybrid-friendly culture that supports your well-being and empowers you to grow. Our Be Well programs are thoughtfully designed to support your financial, mental, physical, and social health because we know that when you feel your best, you do your best. From your very first day, you’ll dive into impactful work that powers the systems our customers rely on every day. You won’t just contribute—you’ll make a difference, tackling meaningful projects that sharpen your skills and fuel your growth. We’re here to champion your journey. With powerful tools to chart your career path, personalized development goals aligned with your ambitions, and continuous feedback to keep you inspired and on track, you’ll have everything you need to thrive and evolve. You’ll develop in-demand skills to grow your career and achieve your ambitions with access to cutting-edge learning opportunities—from certifications with Microsoft, Google, and Amazon to coaching and hands-on experiences. And through it all, you’ll be part of a culture that values empathy, restless learning, and a devotion to shared success. We want you to thrive here—and we’re committed to helping you do just that. Ready to make an impact? Join us and help shape what’s next.

At Kyndryl, we achieve progress the world depends on, with purpose. Beginning with the purpose that matters to you. Because here, you will be part of a culture designed with purpose. One that is restless, empathetic and devoted. Where we are committed to sustainable progress for our customers and supporting the communities where we work and live. All of you is what we want. And what we need. Join us, and together, we can advance the vital systems that power human progress.