Incident Response Specialist to investigate and respond to complex Level 2 cybersecurity incidents using EDR and digital forensics- 2428

S I Systems; Toronto; Hybrid; CAD 90,000 - 120,000; Full time

Job summary

S.I. Systems Ltd.

in Toronto is seeking an Incident Response Specialist to investigate and respond to complex Level 2 cybersecurity incidents using EDR and digital forensics, supporting a mature incident response program within a leading financial institution. You will monitor 24/7 security operations, coordinate with Threat Intelligence, Detection, Incident Management, and GSOC, and contribute to procedures, governance, and continuous improvement.

Qualifications

• 3–4 years in Incident Response within Security Operations
• 3–4 years incident response using EDR tooling
• 2–3 years in Digital forensics / forensic analysis
• 3–4 years in Live response analysis and host activity timelines

Responsibilities

• Investigate escalated Level 2 cybersecurity incidents
• Produce high-quality incident documentation
• Collaborate with Threat Intelligence, Detection, Incident Management, and GSOC teams
• Monitor mission-critical Information Security systems 24/7/365
• Maintain security tools and applications
• Coordinate incident management activities, including engaging third-party providers
• Develop procedures and processes conforming to industry best practices and policies

Skills

Incident Response

EDR tooling

Digital forensics

Live response

Education

Post-secondary degree in Business or Computer Science

Tools

EDR tooling

Digital forensics tooling

Job description

Incident Response Specialist to investigate and respond to complex Level 2 cybersecurity incidents using EDR and digital forensics- 2428

Our financial services client is seeking a Incident Response Specialist to investigate and respond to complex Level 2 cybersecurity incidents using EDR and digital forensics- 2428

Join a mature, advanced incident response program within a leading financial institution, driving real-world investigations at enterprise scale. You will investigate escalated Level 2 incidents, produce high-quality incident documentation, collaborate with Threat Intelligence, Detection, Incident Management, and GSOC teams, and contribute to operational readiness and continuous improvement. Gain exposure to advanced EDR tooling and forensic analysis with visibility across enterprise security operations. Hybrid model with office flexibility (downtown Toronto, Scarborough, Barrie) and a compressed 4x10 schedule with weekend/holiday coverage; shift hours 10:30AM–8:20PM EST.

Location: Hybrid/Toronto, S carborough, or Barrie office.( Hybrid will be any 2 days between Wednesday to Friday)

Duration: 1 Years

Shifts: This role follows a compressed work schedule of 4 days per week, with 10-hour shifts. This includes weekends and Statutory holidays unless vacation time is booked.. Shift assignments will be either Sunday–Wednesday or Wednesday–Saturday, based on business needs and determined by the leadership team.

Shift hours: 10:30AM EST – 8:20PM EST

Must Haves

• 3–4 years in Incident Response within Security Operations
• 3–4 years incident response using EDR tooling
• 2–3 years in Digital forensics / forensic analysis
• 3–4 years in Live response analysis and host activity timelines
• Post-secondary degree in Business or Computer Science, or related field (or equivalent training, certifications, or work experience)

Nice to Have

• Certification from a recognized institution (ISC)2, ISACA, or SANS

Responsibilities

• Investigate escalated Level 2 cybersecurity incidents
• Produce high-quality incident documentation
• Collaborate with Threat Intelligence, Detection, Incident Management, and GSOC teams
• Monitor mission-critical Information Security systems 24/7/365
• Maintain security tools and applications
• Coordinate incident management activities, including engaging third-party providers
• Develop procedures and processes conforming to industry best practices and policies

Our financial services client is seeking a Incident Response Specialist to investigate and respond to complex Level 2 cybersecurity incidents using EDR and digital forensics- 2428

Join a mature, advanced incident response program within a leading financial institution, driving real-world investigations at enterprise scale. You will investigate escalated Level 2 incidents, produce high-quality incident documentation, collaborate with Threat Intelligence, Detection, Incident Management, and GSOC teams, and contribute to operational readiness and continuous improvement. Gain exposure to advanced EDR tooling and forensic analysis with visibility across enterprise security operations. Hybrid model with office flexibility (downtown Toronto, Scarborough, Barrie) and a compressed 4x10 schedule with weekend/holiday coverage; shift hours 10:30AM–8:20PM EST.

Location: Hybrid/Toronto, S carborough, or Barrie office.( Hybrid will be any 2 days between Wednesday to Friday)

Duration: 1 Years

Hours: 37.5 Hours Per Week

Shifts: This role follows a compressed work schedule of 4 days per week, with 10-hour shifts. This includes weekends and Statutory holidays unless vacation time is booked.. Shift assignments will be either Sunday–Wednesday or Wednesday–Saturday, based on business needs and determined by the leadership team.

Shift hours: 10:30AM EST – 8:20PM EST

Must Haves

• 3–4 years in Incident Response within Security Operations
• 3–4 years incident response using EDR tooling
• 2–3 years in Digital forensics / forensic analysis
• 3–4 years in Live response analysis and host activity timelines
• Post-secondary degree in Business or Computer Science, or related field (or equivalent training, certifications, or work experience)

Nice to Have

• Certification from a recognized institution (ISC)2, ISACA, or SANS

Responsibilities

• Investigate escalated Level 2 cybersecurity incidents
• Produce high-quality incident documentation
• Collaborate with Threat Intelligence, Detection, Incident Management, and GSOC teams
• Monitor mission-critical Information Security systems 24/7/365
• Maintain security tools and applications
• Coordinate incident management activities, including engaging third-party providers
• Develop procedures and processes conforming to industry best practices and policies

Disclaimer:

AI may be used in evaluating candidates.

This posting is for an existing vacancy.