Incident Response Specialist

Swoon; Toronto; Hybrid; CAD 53,000 - 60,000; Full time

Job summary

Swoon is seeking a Security Operations professional in the Toronto area (Hybrid - 2 days/week) to respond to escalated Level 2 cybersecurity incidents. The role requires investigating complex breaches, performing digital forensics, live response, and endpoint activity reviews.

You'll use EDR tools to identify, contain, and mitigate threats, develop host activity timelines, and prepare detailed incident reports. Weekend and holiday coverage may be required as part of the shift rotations.

Qualifications

• 3–4 years of experience in Security Operations, Cybersecurity, or Incident Response.
• 3–4 years of experience investigating and responding to security breaches.
• 3–4 years of hands-on experience with EDR tools and endpoint threat investigations.
• 2–3 years of experience in Digital Forensics and forensic analysis.
• Experience conducting live response investigations and developing host activity timelines.
• Experience preparing incident response reports and operational documentation.
• Strong analytical, troubleshooting, and problem‑solving skills.
• Excellent written and verbal communication skills.
• Post‑secondary education in Computer Science, Information Technology, Business, or a related discipline, or equivalent practical experience.
• Relevant cybersecurity certifications (CISSP, CISM, CISA, SANS, or similar) are considered an asset.

Responsibilities

• Investigate and respond to escalated Level 2 cybersecurity incidents, including complex security breaches.
• Conduct digital forensic investigations, live response analysis, and endpoint activity reviews.
• Leverage Endpoint Detection and Response (EDR) tools to identify, investigate, contain, and mitigate security threats.
• Develop host activity timelines and analyze forensic evidence to determine the scope and impact of incidents.
• Prepare detailed incident reports, investigation findings, and technical documentation.
• Coordinate incident response activities with internal security teams and external technology partners.
• Monitor, maintain, and support enterprise security tools and applications.
• Identify opportunities to improve incident response processes, operational procedures, and security capabilities.

Skills

Security Operations

Cybersecurity

Incident Response

Digital Forensics

Education

Post-secondary education

Tools

EDR tools

Job description

Location:

Toronto, Scarborough, or Barrie, ON (Hybrid - 2 days/week)

Contract Opportunity - 1 Year with potential to extend

Pay Rate:

• T4 - $38.51
• INC - $43.71

Work Arrangement & Schedule

• Hybrid work model with offices in Downtown Toronto, Scarborough, or Barrie.
• Four 10-hour shifts per week.
• Shift hours: 10:20 AM – 8:20 PM EST.
• Available rotations: Sunday–Wednesday or Wednesday–Saturday.
• Weekend and statutory holiday coverage is required.
• Shift assignments are determined by business requirements.

What You'll Be Doing

• Investigate and respond to escalated Level 2 cybersecurity incidents, including complex security breaches.
• Conduct digital forensic investigations, live response analysis, and endpoint activity reviews.
• Leverage Endpoint Detection and Response (EDR) tools to identify, investigate, contain, and mitigate security threats.
• Develop host activity timelines and analyze forensic evidence to determine the scope and impact of incidents.
• Prepare detailed incident reports, investigation findings, and technical documentation.
• Coordinate incident response activities with internal security teams and external technology partners.
• Monitor, maintain, and support enterprise security tools and applications.
• Identify opportunities to improve incident response processes, operational procedures, and security capabilities.

What We're Looking For

• 3–4 years of experience in Security Operations, Cybersecurity, or Incident Response.
• 3–4 years of experience investigating and responding to security breaches.
• 3–4 years of hands-on experience with EDR tools and endpoint threat investigations.
• 2–3 years of experience in Digital Forensics and forensic analysis.
• Experience conducting live response investigations and developing host activity timelines.
• Experience preparing incident response reports and operational documentation.
• Strong analytical, troubleshooting, and problem‑solving skills.
• Excellent written and verbal communication skills.
• Post‑secondary education in Computer Science, Information Technology, Business, or a related discipline, or equivalent practical experience.

Relevant cybersecurity certifications (CISSP, CISM, CISA, SANS, or similar) are considered an asset.