Incident Response Commander/Forensic Analyst

Forensic Focus Limited; Montreal (administrative region); Hybrid; CAD 83,000 - 193,000; Full time

Job summary

Forensic Focus Limited seeks an experienced DFIR contractor to lead incident response operations across triage, containment, eradication and recovery, and to conduct in-depth forensic analysis of Windows, Linux and macOS systems, memory images, and network traffic.

The role requires independence, strong communication with executive and legal stakeholders, and ability to manage multi-client engagements in regulated environments.

Qualifications

• Experience leading war-room incidents and client-facing reporting.
• Proficiency with forensic collection tools such as KAPE, Velociraptor, UAC and CyLR for evidence gathering.
• Experience with memory and file analysis tools like Volatility and MemProcFS.

Responsibilities

• Lead incident response operations for multiple clients in real time.
• Coordinate with executive and legal stakeholders and regulatory reporting.
• Perform deep forensic analysis across Windows, Linux and macOS systems, memory images, and network traffic.

Skills

DFIR expertise

Incident response leadership

Regulatory awareness

Client communication

Tools

KAPE

Velociraptor

UAC

CyLR

Volatility

MemProcFS

Job description

The RoleThis contractor position spans two disciplines: leading incident response operations — from initial triage and live endpoint collection through containment, eradication and recovery — and conducting in-depth digital forensic analysis of Windows, Linux and macOS systems, memory images and network traffic, while coordinating client communications and regulatory reporting.

Skills & Experience

Candidates should be proficient with forensic collection tools such as KAPE, Velociraptor, UAC and CyLR, and analysis platforms including Volatility and MemProcFS. Experience with EDR-based IR, Active Directory attack techniques (Kerberoasting, golden/silver tickets), IOC development (YARA, Sigma), and knowledge of NIS2 and relevant cybersecurity legislation is expected.

Who It Suits

This role suits an experienced DFIR professional comfortable operating independently as a freelancer or contractor, who can lead war-room incidents, communicate with executive and legal stakeholders, and perform deep forensic analysis — ideally with exposure to regulated environments and multi-client consulting engagements.