Senior Consultant or Manager, Digital Forensics

BDO; Toronto; Hybrid; CAD 80,000 - 110,000; Full time

Job summary

A leading cybersecurity firm in Toronto is seeking a Senior Consultant or Manager in Digital Forensics & Incident Response. The successful candidate will lead complex incident investigations, perform forensic examinations, and produce actionable intelligence reports. Candidates should have 3-5 years of experience in related roles and possess strong analytical and communication skills. This position offers the opportunity to work in a collaborative environment while fostering career growth and professional development.

Benefits

Competitive salary

Flexible benefits

Personal time off policy

Wellness initiatives reimbursement

Qualifications

• Minimum 3-5 years of experience in digital forensics or incident response roles.
• Demonstrated experience with forensic tools and methodologies.
• Strong verbal and written communication skills.

Responsibilities

• Lead complex incident investigations and forensic engagements.
• Perform digital forensic examinations across multiple operating systems.
• Produce clear incident investigation and forensic reports.

Skills

Digital forensics

Incident response

Threat intelligence

Data analysis

Communication skills

Mentoring

Education

Undergraduate degree or diploma in Computer Science, Cyber Security, Forensics

Tools

EDR

SIEM

EnCase

Wireshark

Job description

Putting people first, every day

BDO is a firm built on a foundation of positive relationships with our people and our clients. Each day, our professionals provide exceptional service, helping clients with advice and insight they can trust. In turn, we offer an award-winning environment that fosters a people-first culture with a high priority on your personal and professional growth.

Your Opportunity

BDO is seeking an experienced Digital Forensics & Incident Response professional to join our growing Cyber Security team. The successful candidate will bring deep investigative and forensic skills to defend our clients from sophisticated cyber-adversaries. If you're passionate about forensic analysis, incident response, threat intelligence, and building next-generation capabilities, this is the opportunity for you. We support career growth, collaboration, and innovation across our team.

As a Senior Consultant or Manager, in Digital Forensics & Incident Response on BDO's Cyber Threat Management & Response team, your responsibilities will include:

• Leading complex incident investigations and forensic engagements: endpoint, network, cloud-native environments, memory, disk, and log analysis.
• Performing digital forensic examinations across multiple operating systems and devices using industry-standard tools (e.g., EDR/EDR-forensics, EnCase, Rekall, Wireshark, etc.).
• Collecting, analyzing, and maintaining critical data sources including system logs, network traffic captures, EDR telemetry, threat intelligence feeds in order to support investigations and remediation.
• Interpreting forensic artifacts, identify Indicators of Compromise (IoCs) and adversary Techniques, Tactics & Procedures (TTPs), and producing actionable intelligence.
• Producing clear, professional incident investigation and forensic reports; translating technical findings into business-relevant recommendations for clients or internal stakeholders.
• Contributing to and refine incident response, forensic and threat-hunting playbooks, processes and toolsets.
• Collaborating with SOC, threat-hunting, engineering, and client teams; providing mentorship and training to more junior analysts.
• Staying current with emerging threats, forensic methodologies, cloud/enterprise forensics, and the evolving DFIR toolset; driving innovation and continuous improvement across the team.

How we define success for your role:

• You demonstrate BDO's core values: Integrity, Respect and Collaboration in all aspects of your work.
• Clients describe you as positive, professional, delivering high-quality investigations and forensic insights.
• You show proven success in incident response/forensics engagements and effectively partner with internal/external stakeholders.
• You focus on delivering effective service and clear outcomes, not just technical analysis, but actionable remediation.
• You foster an inclusive and engaging work environment; you actively contribute to talent development, best practice sharing and innovation.
• You proactively adopt digital tools and strategies that elevate forensic, detection and response capabilities.
• You continuously grow your expertise and participate in professional development.

Your experience and education

Undergraduate degree or diploma in Computer Science, Cyber Security, Forensics or related discipline.

Minimum 3-5 years (or more, depending on seniority) experience in digital forensics, incident response or similar roles.

Demonstrated experience with EDR/XDR, SIEM, network/endpoint forensics, malware triage, memory/disk analysis.

Familiarity with forensic tools, methodologies, chain-of-custody, evidence handling.

Solid understanding of adversary TTPs, log analysis, threat intelligence, and frameworks such as MITRE ATT&CK.

Strong verbal and written communication skills—able to translate technical investigation into business / client-relevant findings.

Strong analytical mindset; critical thinker comfortable operating under incident response deadlines.

Prior consulting or client-facing forensic/IR experience.

Experience in cloud/virtual environments (Azure, AWS, GCP), and forensics in hybrid/cloud contexts.

Experience coding or scripting (e.g., Python), or query languages (KQL, SQL) for forensic data analysis.

Experience mentoring others or leading smaller forensic/IR teams.

Certification(s) Preferred:

• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Certified Forensic Analyst (GCFA
• GIAC Network Forensic Analyst (GNFA)
• GIAC Reverse Engineering Malware (GREM)
• CrowdStrike Certified Falcon Responder (CCFR), or similar.

Certification(s) Preferred (Secondary):

• Certified Information Systems Security Professional (CISSP),
• Certified Cloud Security Professional (CCSP)
• Certified Information Systems Auditor (CISA)
• Certified Information Security Manager (CISM)
• Cloud platform security certifications (Azure, AWS, etc.).

Why BDO?

Our people-first approach to talent has earned us a spot among Canada's Top 100 Employers for 2025. This recognition is a milestone we're thrilled to add to our collection of awards for both experienced and student talent experiences.

Our firm is committed to providing an environment where you can be successful in the following ways:

We enable you to engage with how we change and evolve, being a key contributor to the success and growth of BDO in Canada.

We help you become a better professional within our services, industries, and markets with extensive opportunities for learning and development.

We support your achievement of personal goals outside of the office and making an impact on your community.

Giving back adds up: Where company meets community. BDO is actively involved in our communities by supporting local charity initiatives. We support staff with local and national events where you will be given the opportunity to contribute to your community.

Total rewards that matter:

We pay for performance with competitive total cash compensation that recognizes and rewards your contribution. We provide flexible benefits from day one, and a market leading personal time off policy. We are committed to supporting your overall wellness beyond working hours and provide reimbursement for wellness initiatives that fit your lifestyle.

Everyone counts:

We believe every employee should have the opportunity to participate and succeed. Through leadership by our Diversity, Equity and Inclusion Leader, we are committed to a workplace culture of respect, inclusion, and diversity. We recognize and celebrate the valuable differences among each of us, including race, religious beliefs, physical or mental disabilities, age, place of origin, marital status, family status, gender or gender identity and sexual orientation. If you require accommodation to complete the application process, please contact us.

Flexibility:

All BDO personnel are expected to spend some of their time working in the office, at the client site, and virtually unless accommodations or alternative work arrangements are in place. Our model is a blended approach designed to support the flexible needs of our people, the firm and our clients. It's about creating work experiences that meet everyone's needs and providing flexibility to adjust when, where and how we work to meet the expectations of our role.

Code of Conduct:

Our Code of Conduct sets clear standards for how we conduct business. It reflects our shared values and commitments and includes guiding principles to help us make ethical decisions and maintain trust with each other, our clients, and the public.

With your consent, BDO Canada may use AI technology (Microsoft Copilot) to transcribe during preliminary conversations, solely for the purpose of note-taking and not for other purposes, such as resume review, evaluation or selection of candidates.

More information on BDO Canada's Privacy Policy can be found here: Privacy Policy | BDO Canada

Ready to make your mark at BDO? Click "Apply now" to send your up-to-date resume to one of our Talent Acquisition Specialists.

To explore other opportunities at BDO, check out our careers page.