DFIR / Incident Response Specialist

Arobas Personnel; Montreal; On-site; CAD 83,000 - 152,000; Part time

Job summary

Forensic Focus is seeking a contract DFIR practitioner to investigate and respond to security incidents across endpoints, networks, memory and cloud systems. You will perform in-depth forensic analyses, establish timelines and root causes, and support containment and recovery efforts.

The ideal candidate works independently, has strong expertise in digital forensics and incident response, and can document detailed forensic findings for stakeholders and legal considerations.

Qualifications

• Requires expertise in digital forensics and incident response.
• Experience with evidence collection, chain-of-custody and IOC/TTP identification.

Responsibilities

• Investigate and respond to security incidents across endpoints, networks, memory and cloud systems.
• Triages escalated alerts and conducts forensic analysis to establish root cause and timelines.
• Support containment and recovery efforts.

Skills

Digital forensics

Incident response

Evidence handling

Chain of custody

IOC identification

TTP identification

SOC collaboration

Red Team liaison

Job description

The Role

This contract position involves investigating and responding to security incidents, triaging escalated alerts, and conducting forensic analysis across endpoints, networks, memory and cloud systems to establish root cause and timelines, while supporting containment and recovery efforts.

Skills & Experience

Requires strong expertise in digital forensics and incident response, evidence collection and chain-of-custody practices, IOC and TTP identification, and collaboration with SOC, CTI, Detection Engineering and Red Team functions.

Who It Suits

Ideal for an experienced DFIR practitioner comfortable working independently on a contract basis, who enjoys technical investigation work and producing detailed forensic and incident reports.