Incident Response Consultant

Required Skills & Experience

• 3–5 years of experience working in Incident Response (IR) or SOC Level 2 within medium to large enterprises

• Strong understanding of security logs, telemetry, and the detection/response lifecycle

• Hands-on experience with SIEM platforms (Splunk) for log validation and telemetry validation

• Experience with log ingestion, parsing, normalization, and data quality assessment

• Ability to evaluate whether logs support detection and investigation use cases

• Experience reviewing security architecture diagrams and understanding data flows

• Ability to define logging requirements and identify gaps during project reviews

• Strong stakeholder management skills with the ability to lead technical discussions across teams

• Ability to translate security requirements into clear, actionable guidance

• High level of persistence, ownership, and ability to manage multiple concurrent initiatives

Nice to Have Skills & Experience

• Familiarity with cloud logging ecosystems (AWS, Azure, SaaS platforms)

• Understanding of distributed systems logging (e.g., correlation IDs, tracing)

• Experience with UEBA platforms such as Exabeam

• Strong documentation and requirements-writing skills

• Experience designing logging standards or observability strategies

• Experience with security reviews or governance processes

• Familiarity with workflow/intake tools (ServiceNow, Jira)

• Knowledge of MITRE ATT&CK and threat-based detection design

• Experience writing detections using tools such as Splunk, Sigma, KQL, or Logscale

• Ability to simplify complex technical concepts for non-technical stakeholders

Job Description

Insight Global is looking for an Incident Response Consultant to join a large banking client on a 6-month contract with potential extension, working hybrid in downtown Toronto (2 days/week onsite, Wednesday as a core day). The successful candidate will support the Global Security Operations Center (GSOC) and play a key role in evaluating cybersecurity tooling and onboarding initiatives tied to monitoring and response programs.

This individual will spend approximately 60% of their time reviewing security-related projects (including AI and cybersecurity tooling changes) to determine whether tools should be integrated into the organization’s monitoring ecosystem. This includes reviewing security architecture diagrams, assessing risks, and ensuring data from tools is properly routed into centralized platforms. The remaining 40% of the role will focus on log onboarding and log quality - ensuring the right telemetry is captured within SIEM and UEBA platforms, identifying gaps, and validating detection and investigation capabilities. This is a highly collaborative role involving coordination across multiple technical and business teams.

Pay: 50/hr to 60/hr CAD

Vacancy: New Vacancy (New Role)

We use Artificial intelligence tools are used to assist in screening and assessing applicants for this position.