Senior SOC Lead: Incident Response & Threat Hunting

KPMG International; Toronto; On-site; CAD 74,000 - 123,000; Full time

Job summary

KPMG in Canada is seeking a dynamic Senior Cyber Security professional to join our Cyber Security Services team in Toronto. You will lead incident response efforts, guide SOC analysts, and help advance threat detection and cloud security across services.

The role emphasizes hands-on security operations, governance, and collaboration with CSIRT, CTI, and engineering teams to deliver end-to-end cyber security transformations.

Qualifications

• Requires 7+ years in a SOC or security operations role.
• Certifications such as CISSP, CISM, SANS, CISA, and CompTIA security certs are preferred.
• Hands-on experience with SIEM/SOAR tech and Microsoft Defender endpoints.

Responsibilities

• Serve as primary incident contact for high-severity events with CSIRT collaboration.
• Evaluate escalated L2 SOC issues for business risk impact.
• Review logs and refine threat-detection rules and alerts.
• Coordinate with SIEM Engineers to improve alert coverage.
• Develop and maintain incident response playbooks and consider automation.
• Collaborate with CTI teams to enhance threat detection using TTPs.
• Analyze security events and tickets to improve incident management.
• Stay updated on threats, tools, and cloud security advancements.
• Track incidents against MITRE ATT&CK and other frameworks.
• Provide technical leadership and mentorship to analysts.

Skills

Incident response

SOC operations

Threat detection

Leadership

Communication

Azure Sentinel

Education

CISSP

CISM

SANS

CISA

CompTIA Security+

CompTIA CySA+

GIAC

Tools

Microsoft Sentinel

SIEM/SOAR

Microsoft Defender Endpoint

CSPM/CWP

EDR/XDR tools

Job description

KPMG in Canada is seeking a dynamic Senior Cyber Security professional to join our Cyber Security Services team in Toronto. You will lead incident response efforts, guide SOC analysts, and help advance threat detection and cloud security across services.

The role emphasizes hands-on security operations, governance, and collaboration with CSIRT, CTI, and engineering teams to deliver end-to-end cyber security transformations.