Incident Response Consultant

Insight Global; Toronto; Hybrid; CAD 90,000 - 120,000; Full time

Job summary

Insight Global is seeking an Incident Response Consultant to join a banking client on a 6-month contract, hybrid in downtown Toronto (2 days onsite, core day Wednesday). You will help evaluate cybersecurity tooling, onboarding initiatives, and monitoring/response programs with the GSOC.

The role splits time between reviewing projects for tool integration and hands-on log onboarding to ensure proper telemetry in SIEM/UEBA. Collaboration across multiple teams is essential to success.

Qualifications

• 5+ years in Incident Response or SOC Level 2.
• Experience with SIEM for log validation and telemetry validation.
• Ability to translate security requirements into guidance for teams.

Responsibilities

• Review security-related projects to assess tool integration into monitoring ecosystem.
• Assess risks and ensure data from tools routes into centralized platforms.
• Lead log onboarding and ensure telemetry quality in SIEM/UEBA.
• Coordinate across technical and business teams on security initiatives.
• Support GSOC and onboarding initiatives for monitoring and response.

Skills

IR/SOC experience

Security logs understanding

SIEM (Splunk) experience

Log ingestion and normalization

Detection/investigation use cases

Security architecture review

Logging requirements definition

Stakeholder management

Translate security requirements

multitask leadership

Tools

Splunk

Exabeam

ServiceNow

Jira

Sigma

KQL

Logscale

Job description

• 3–5 years of experience working in Incident Response (IR) or SOC Level 2 within medium to large enterprises
• Strong understanding of security logs, telemetry, and the detection/response lifecycle
• Hands-on experience with SIEM platforms (Splunk) for log validation and telemetry validation
• Experience with log ingestion, parsing, normalization, and data quality assessment
• Ability to evaluate whether logs support detection and investigation use cases
• Experience reviewing security architecture diagrams and understanding data flows
• Ability to define logging requirements and identify gaps during project reviews
• Strong stakeholder management skills with the ability to lead technical discussions across teams
• Ability to translate security requirements into clear, actionable guidance
• High level of persistence, ownership, and ability to manage multiple concurrent initiatives

Nice to Have Skills & Experience

• Familiarity with cloud logging ecosystems (AWS, Azure, SaaS platforms)
• Understanding of distributed systems logging (e.g., correlation IDs, tracing)
• Experience with UEBA platforms such as Exabeam
• Strong documentation and requirements-writing skills
• Experience designing logging standards or observability strategies
• Experience with security reviews or governance processes
• Familiarity with workflow/intake tools (ServiceNow, Jira)
• Knowledge of MITRE ATT&CK and threat-based detection design
• Experience writing detections using tools such as Splunk, Sigma, KQL, or Logscale
• Ability to simplify complex technical concepts for non-technical stakeholders

Job Description

Insight Global is looking for an Incident Response Consultant to join a large banking client on a 6-month contract with potential extension, working hybrid in downtown Toronto (2 days/week onsite, Wednesday as a core day). The successful candidate will support the Global Security Operations Center (GSOC) and play a key role in evaluating cybersecurity tooling and onboarding initiatives tied to monitoring and response programs.

This individual will spend approximately 60% of their time reviewing security-related projects (including AI and cybersecurity tooling changes) to determine whether tools should be integrated into the organization’s monitoring ecosystem. This includes reviewing security architecture diagrams, assessing risks, and ensuring data from tools is properly routed into centralized platforms. The remaining 40% of the role will focus on log onboarding and log quality—ensuring the right telemetry is captured within SIEM and UEBA platforms, identifying gaps, and validating detection and investigation capabilities. This is a highly collaborative role involving coordination across multiple technical and business teams.

We use artificial intelligence tools to assist with the screening, assessment, and selection of applicants for this position.

Vacancy: This posting is for a currently vacant role, and the successful candidate will be hired into an existing open position.