SOC 3 Lead: Incident Response & Digital Forensics

Forensic Focus; Toronto; On-site; CAD 120,000 - 170,000; Full time

Job summary

Forensic Focus in Toronto seeks a senior cybersecurity professional to lead investigations into complex incidents, guiding containment, eradication and recovery while performing root cause analysis. You will conduct digital forensics across endpoints, servers, networks and cloud environments, with proactive threat hunting and IR playbooks.

The role requires deep expertise in incident response, digital forensics, malware analysis and threat intelligence, plus familiarity with SIEM (Sentinel,

Qualifications

• Extensive experience in incident response, digital forensics, malware analysis, and threat intelligence across Windows, Linux, macOS and cloud environments.
• Familiarity with SIEM tools Sentinel, Splunk or QRadar and EDR platforms such as CrowdStrike is expected.
• Certifications GIAC, GCFA, GCIH, CISSP or CISA are assets.

Responsibilities

• Lead investigations into complex cybersecurity incidents, including containment, eradication, recovery, and root‑cause analysis.
• Conduct digital forensic examinations across endpoints, servers, networks and cloud infrastructure.
• Perform proactive threat hunting and develop incident response playbooks and remediation plans.

Skills

Incident response

Digital forensics

Malware analysis

Threat intelligence

Leadership

Education

Certifications (asset) GIAC, GCFA, GCIH, CISSP, CISA

Tools

Sentinel

Splunk

QRadar

CrowdStrike

Job description

Forensic Focus in Toronto seeks a senior cybersecurity professional to lead investigations into complex incidents, guiding containment, eradication and recovery while performing root cause analysis. You will conduct digital forensics across endpoints, servers, networks and cloud environments, with proactive threat hunting and IR playbooks.

The role requires deep expertise in incident response, digital forensics, malware analysis and threat intelligence, plus familiarity with SIEM (Sentinel,