SOC 3 Lead Analyst

Altis; Toronto; On-site; CAD 120,000 - 170,000; Full time

Job summary

Forensic Focus in Toronto seeks a senior cybersecurity professional to lead investigations into complex incidents, guiding containment, eradication and recovery while performing root cause analysis. You will conduct digital forensics across endpoints, servers, networks and cloud environments, with proactive threat hunting and IR playbooks.

The role requires deep expertise in incident response, digital forensics, malware analysis and threat intelligence, plus familiarity with SIEM (Sentinel,

Qualifications

• Extensive experience in incident response, digital forensics, malware analysis, and threat intelligence across Windows, Linux, macOS and cloud environments.
• Familiarity with SIEM tools Sentinel, Splunk or QRadar and EDR platforms such as CrowdStrike is expected.
• Certifications GIAC, GCFA, GCIH, CISSP or CISA are assets.

Responsibilities

• Lead investigations into complex cybersecurity incidents, including containment, eradication, recovery, and root‑cause analysis.
• Conduct digital forensic examinations across endpoints, servers, networks and cloud infrastructure.
• Perform proactive threat hunting and develop incident response playbooks and remediation plans.

Skills

Incident response

Digital forensics

Malware analysis

Threat intelligence

Leadership

Education

Certifications (asset) GIAC, GCFA, GCIH, CISSP, CISA

Tools

Sentinel

Splunk

QRadar

CrowdStrike

Job description

The RoleThis position leads investigations into complex cybersecurity incidents, covering containment, eradication, recovery, and root cause analysis. Responsibilities include conducting digital forensic examinations across endpoints, servers, networks, and cloud infrastructure, proactive threat hunting, and developing incident response playbooks and remediation plans.

Skills & ExperienceRequires extensive experience in incident response, digital forensics, malware analysis, and threat intelligence across Windows, Linux, macOS and cloud environments. Familiarity with SIEM tools like Sentinel, Splunk, or QRadar and EDR platforms such as CrowdStrike is expected. GIAC, GCFA, GCIH, CISSP or CISA certifications are assets.

Who It SuitsIdeal for a senior cybersecurity professional comfortable leading high-stakes investigations, mentoring teams, and communicating technical findings to both technical and business stakeholders within a regulated financial services environment.