Incident Response Analyst-EDR/Banking

BeachHead; Toronto; On-site; CAD 90,000 - 120,000; Full time

Job summary

Forensic Focus is seeking a mid-level security professional to handle escalated cybersecurity incidents in a large banking environment. You will perform live response analysis, develop host activity timelines, and contain threats using EDR tooling while coordinating with internal teams and external providers.

The role requires 3–4 years in security operations and incident response, plus 2–3 years in digital forensics, with strong writing and communication skills.

Qualifications

• Three to four years in security operations and incident response.
• Experience investigating breaches and using endpoint detection and response tooling.
• Two to three years in digital forensics.
• Strong analytical, documentation, and communication skills; security certifications are a plus.

Responsibilities

• Investigate escalated cybersecurity incidents in a banking environment.
• Perform live response analysis and host activity timeline development.
• Contain threats using EDR tools and coordinate containment actions.
• Prepare incident reports and collaborate with internal security teams and external providers.

Skills

Security operations

Incident response

Digital forensics

EDR tooling

Tools

EDR tooling

Forensic tooling

Job description

The Role

This position involves investigating escalated cybersecurity incidents, including breach-class events, within a banking environment. Duties include live response analysis, host activity timeline development, threat containment using EDR tools, incident reporting, and collaborating with internal security teams and external providers to maintain operational readiness.

Skills & Experience

Candidates need three to four years in security operations and incident response, with experience investigating breaches, using endpoint detection and response tooling, and two to three years in digital forensics. Strong analytical, documentation, and communication skills are required; security certifications are a plus.

Who It Suits

Suited to a mid-level security professional with solid incident response and forensic analysis experience who wants to work within a large financial institution's security operations function, handling complex, enterprise-scale investigations.