Sr. Cyber Consultant, DFIR

Forensic Focus Limited; Canada; Hybrid; CAD 95,000 - 158,000; Full time

Job summary

Forensic Focus Limited seeks a Senior Cyber Consultant to lead end-to-end incident response engagements in a Canada-based role. You will conduct forensic examinations of servers, workstations, and SaaS platforms, preserve evidence, analyze logs, and deliver detailed reports to diverse audiences.

Strong communication and independent work ethic are essential. Required experience in DFIR, proficiency with X-Ways, and familiarity with NIST/SANS frameworks and cloud platforms such as Azure, AWS, GCP,

Qualifications

• Proven DFIR experience and hands-on proficiency with forensic tooling such as X-Ways.
• Familiarity with IR frameworks (NIST, SANS), cloud platforms (Azure, AWS, GCP, Oracle).
• Strong written and verbal communication skills; industry-recognised certifications preferred.

Responsibilities

• Lead end-to-end incident response engagements from identification to recovery.
• Perform forensic examination of servers, workstations, and SaaS platforms.
• Preserve evidence, analyze logs, and author detailed narrative reports for technical and non-technical audiences.

Skills

DFIR experience

IR frameworks

Cloud platforms

Python

PowerShell

Communication skills

Independent work

Client coordination

Tools

X-Ways

Job description

# Sr. Cyber Consultant, DFIR*LevelBlue***Canada**Senior · Full-time### The RoleThis senior consulting position sits within a global DFIR practice and involves leading end-to-end incident response engagements — from identification and containment through to eradication and recovery. Day-to-day work includes forensic examination of servers, workstations and SaaS platforms, evidence preservation, log analysis, and authoring detailed narrative reports for both technical and non-technical audiences.### Skills & ExperienceCandidates should bring proven DFIR experience and hands-on proficiency with forensic tooling such as X-Ways. Familiarity with IR frameworks (NIST, SANS), cloud platforms (Azure, AWS, GCP, Oracle), network protocols, and scripting languages such as Python or PowerShell is valued. Industry-recognised DFIR certifications are preferred alongside strong written and verbal communication skills.### Who It SuitsThis role suits an experienced DFIR professional who is comfortable working independently against engagement milestones, managing multiple concurrent cases, and collaborating with client-side legal, IT and compliance teams. Those who thrive under pressure in a consulting environment and can communicate complex findings to non-technical audiences will excel here.Typical advertised salary forIncident Response roles in Canada:**C$95,000–C$158,000**(median C$130,000 — from47 recent listings analysed by Forensic Focus).Compare Incident Response salaries in Canada →Certifications mentioned:SANS — find training for these on theDFIR Training Finder.Learn More/Apply