DFIR Manager

Forensic Focus Limited; Canada; Hybrid; CAD 160,000 - 175,000; Full time

Job summary

Groom & Associés / Associates in Canada seeks an experienced DFIR Manager to lead a high-performing DFIR function across global operations, overseeing the full incident lifecycle from triage to post-breach remediation.

You will coordinate cross-functional response teams, maintain chain of custody during investigations, report to senior leadership, and ensure 24x7 operational readiness, with hands-on work and people management in a fast-growing MSS environment.

Qualifications

• Candidates should bring deep expertise in incident response and digital forensics, including traffic analysis, packet captures, and IOC identification.
• Experience developing IR policies, managing DFIR tooling selection, and driving metrics-based performance is essential.
• Familiarity with legal and evidentiary standards and strong stakeholder communication skills are expected.

Responsibilities

• This role leads a high-performing DFIR function across global operations, managing the full incident lifecycle from triage and IOC identification through to post-breach remediation.
• Day-to-day responsibilities include coordinating cross-functional response teams, maintaining chain of custody during forensic investigations, reporting to senior leadership, and ensuring 24×7 operational readiness.

Skills

Incident response

Digital forensics

Traffic analysis

IOC identification

IR policy development

DFIR tooling

Metrics reporting

Legal standards

Stakeholder communication

Tools

DFIR tooling

Job description

# DFIR Manager*Groom & Associés / Associates***Canada**Manager · Full-time · $160,000.00/yr - $175,000.00/yr### The RoleThis role leads a high-performing DFIR function across global operations, managing the full incident lifecycle from triage and IOC identification through to post-breach remediation. Day-to-day responsibilities include coordinating cross-functional response teams, maintaining chain of custody during forensic investigations, reporting to senior leadership, and ensuring 24×7 operational readiness.### Skills & ExperienceCandidates should bring deep expertise in incident response and digital forensics, including traffic analysis, packet captures, and IOC identification. Experience developing IR policies, managing DFIR tooling selection, and driving metrics-based performance is essential. Familiarity with legal and evidentiary standards and strong stakeholder communication skills are expected.### Who It SuitsThis position suits an experienced DFIR professional ready to step into a leadership role within a fast-growing managed security services environment. Those who thrive in metrics-driven, collaborative cultures and enjoy both hands-on technical work and people management will find this role rewarding.Typical advertised salary forIncident Response roles in Canada:**C$95,000–C$162,000**(median C$130,000 — from51 recent listings analysed by Forensic Focus).Compare Incident Response salaries in Canada →Learn More/Apply