Forensic Incident Response Associate – Recovery Services

NextGenEnergyJobs; Toronto; On-site; CAD 90,000 - 130,000; Full time

Benefits offered by this job

Superior benefits package

Wellness program

In-house immigration support

Job summary

NextGenEnergyJobs seeks an Consulting Associate for the Forensic Services practice to execute digital forensics across Windows, Linux, and cloud environments, and to lead recovery workstreams in ransomware matters. You will develop automation tooling in PowerShell and Python, interface with client IT teams, and produce defensible forensic reports.

The role requires 3–5 years in incident response or digital forensics, strong AD/Entra ID knowledge, and excellent written communication.

Qualifications

• 3–5 years of hands-on incident response or digital forensics experience.
• Experience responding to ransomware, BEC, or intrusion matters in enterprise environments.
• Deep working knowledge of Active Directory and Entra ID, attack paths and hardening controls.
• Proficiency with at least one enterprise EDR platform and its response tooling.
• Strong scripting ability in PowerShell; Python a plus.
• Excellent written communication; ability to produce report-quality prose with minimal editing.
• Ability to operate independently under incident conditions and manage priorities.
• Exposure to OT/ICS environments or regulated industries.
• Experience with Google Workspace forensics and admin tooling.

Responsibilities

• Execute digital forensic collection and analysis across Windows, Linux, VMware/Hyper-V, and cloud environments.
• Perform endpoint containment and telemetry analysis using EDR platforms.
• Lead technical recovery workstreams in ransomware matters including domain controller rebuilds.
• Investigate business email compromise and wire fraud via mail-flow and logs.
• Analyze and remediate hybrid identity environments (AD, Entra ID, Conditional Access).
• Develop tooling in PowerShell, Graph SDK, and Python for automation.
• Produce clear, defensible forensic reports and timelines.
• Contribute TE-level effort estimates for engagement scoping.
• Interface with client IT teams, counsel, and carriers during matters.

Skills

Incident response

Digital forensics

PowerShell scripting

Python

EDR tooling

Written communication

Education

GCFA

GCIH

GNFA

GCFE

EnCE

CISSP

Tools

CrowdStrike Falcon

Job description

NextGenEnergyJobs seeks an Consulting Associate for the Forensic Services practice to execute digital forensics across Windows, Linux, and cloud environments, and to lead recovery workstreams in ransomware matters. You will develop automation tooling in PowerShell and Python, interface with client IT teams, and produce defensible forensic reports.

The role requires 3–5 years in incident response or digital forensics, strong AD/Entra ID knowledge, and excellent written communication.