Remote Cybersecurity Incident Investigator

Kyndryl Inc.; United States; Remote; USD 83,000 - 118,000; Full time

Benefits offered by this job

Be Well program

Learning opportunities

Career development

Job summary

Kyndryl is seeking a Cybersecurity Incident Investigator to conduct deep-dive investigations across cloud, identity, and hybrid systems. You will lead end-to-end security inquiries into advanced threats, determine root causes, and deliver defensible timelines and actionable leadership recommendations.

Remote role across Canada with cross-border collaboration, strong focus on regulatory risk, executive reporting, and resilient operational security across enterprise environments.

Qualifications

• Must hold Government of Canada security clearance or be eligible.
• Hands-on IR, digital forensics, or end-to-end security investigations.
• Strong knowledge of identity and access architectures and hybrid cloud security.
• Experience analyzing SIEM telemetry, forensic artifacts, and OS internals.
• Ability to produce executive-ready investigation reports.

Responsibilities

• Conduct deep-dive, end-to-end cybersecurity investigations across enterprise environments.
• Lead investigations into threats including malware, ransomware, and BEC incidents.
• Examine evidence across platforms to determine root cause and initial access vectors.
• Provide actionable recommendations to leadership and maintain regulatory compliance.
• Prepare clear, concise reports and briefs for non-technical stakeholders.

Skills

Cybersecurity IR

Digital forensics

Complex investigations

Identity and access architectures

Microsoft Entra ID / Azure AD

Active Directory

Hybrid cloud security

Executive communication

Remote / distributed work

Tools

Velociraptor

FTK

EnCase

Volatility

KAPE

EDR/XDR platforms

Job description

Kyndryl is seeking a Cybersecurity Incident Investigator to conduct deep-dive investigations across cloud, identity, and hybrid systems. You will lead end-to-end security inquiries into advanced threats, determine root causes, and deliver defensible timelines and actionable leadership recommendations.

Remote role across Canada with cross-border collaboration, strong focus on regulatory risk, executive reporting, and resilient operational security across enterprise environments.