Incident Response Analyst-EDR/Banking

BeachHead; Toronto; On-site; CAD 63,000 - 76,000; Full time

Job summary

BeachHead Inc. collaborates with a major financial client to strengthen cyber defenses and respond to complex incidents.

The Incident Response Analyst-EDR/Banking role involves threat containment, forensic analysis, and cross-team coordination to protect enterprise operations. The position offers exposure to advanced endpoint detection and response tooling, live investigations, and ongoing improvement of security procedures and controls, with a focus on risk-informed decisions and documented

Qualifications

• Three to four years of security operations and incident response experience.

Responsibilities

• Investigate and manage escalated cybersecurity incidents, including breach-class events.

Skills

Incident response experience

Digital forensics

Live response analysis

Host activity timelines

Security operations

Data-driven decision making

Written and verbal communication

Collaboration with stakeholders

Ability to manage multiple priorities

Risk-informed judgment

Education

Post-secondary education in Business/Computer Science/Information Security

Tools

EDR tooling

Forensic analysis tools

Job description

Could you help strengthen enterprise cyber defences through advanced incident response?

Working with one of our top financial clients, this role calls for anIncident Response Analyst-EDR/Bankingto investigate and respond to complex cybersecurity incidents, support threat containment and mitigation, and collaborate with experienced professionals across security operations. This opportunity offers exposure to enterprise-scale investigations, advanced endpoint detection and response tooling, forensic analysis, and operational readiness initiatives. Pay rate range(CAD): $46.01/hr – $55.22/hr

Responsibilities

• Investigate and manage escalated cybersecurity incidents, including breach-class events.
• Conduct digital forensics, live response analysis, and host activity timeline development.
• Use endpoint detection and response tools to monitor, assess, contain, and mitigate threats.
• Coordinate incident management activities with internal security teams and external service providers.
• Monitor and maintain information security tools and applications supporting critical operations.
• Restore services, implement approved changes, and manage operational activities within established service levels.
• Prepare clear, accurate incident reports, activity reports, audit materials, and operational documentation.
• Develop, assess, and improve security procedures, processes, and controls in line with established standards.
• Collaborate with internal and external stakeholders to support information security objectives and operational requirements.
• Provide technical information security expertise during investigations, service requests, projects, and operational initiatives.
• Identify opportunities to improve security capabilities, streamline processes, and strengthen operational efficiency.
• Contribute to knowledge sharing, technical development, mentoring, and continuous improvement initiatives.
• Gather and document requirements for audits, reports, projects, and security-related activities.
• Support the planning and implementation of operational programs and process enhancements.
• Apply risk-informed judgment when protecting information assets and making security decisions.
• Maintain current knowledge of information security practices, technologies, and industry developments.

Desired Skill-Set

• Three to four years of experience in security operations and incident response.
• Three to four years of experience investigating breach-class incidents.
• Two to three years of experience in digital forensics or forensic analysis.
• Three to four years of experience using endpoint detection and response tooling.
• Three to four years of experience developing and assessing operational process documentation.
• Three to four years of experience performing live response analysis and developing host activity timelines.
• Two to three years of experience preparing incident response reports.
• Post-secondary education in Business, Computer Science, Information Security, or a related field, or an equivalent combination of training and experience.
• Experience supporting information security operations or multiple areas of systems and computer operations.
• In-depth knowledge of information security processes, procedures, and controls.
• Strong understanding of information security support and operations concepts, practices, and technologies.
• Strong analytical, problem-solving, and data-driven decision-making skills.
• Strong verbal and written communication skills.
• Effective collaboration, partnering, negotiation, and influencing skills.
• Ability to diagnose and resolve complex information security issues independently.
• Ability to manage multiple priorities, exercise sound judgment, and determine appropriate escalation paths.
• Ability to develop effective relationships with technical, business, and external stakeholders.
• Ability to work within established security policies, standards, procedures, and risk management practices.

Nice to Have

• An information security certification or active pursuit of a related certification through a recognised professional institution.
• Experience with identity and access management, certification and key management, security platform administration, or information security incident response.
• Experience supporting enterprise security operations in a regulated environment.
• Knowledge of security operations across a broad organisational and technology environment.
• Participation in professional associations, practice communities, or ongoing information security learning.

BeachHead is an equal opportunity agency and employer. We advocate for our candidates and welcome applicants regardless of race, color, religion, national origin, sex, age, or physical or mental disability. BeachHead or our clients may use technology-enabled tools, including automation and artificial intelligence (AI), to support parts of the recruitment process such as resume screening, application management, and candidate matching. These tools assist our recruiters and our clients, and do not replace human decision-making. This job posting represents a current or anticipated vacancy. The position may be filled at any time, and the posting may be removed without notice once the role has been filled.