Find work in Canada.

331,200 jobs across our Canadian network. How we count

Jobs in Canada

Save this search

Quality Technical Support Engineer
VoxNeuro
Toronto, ON
Full-time
Job Title: Quality Technical Support Engineer
Security Engineer, Detection & Response
Sentry
Remote, Canada
$162,000 to $420,000 CAD / year
Full-time · Remote
The Security Team is responsible for securing all things Sentry: our customers, our code, and everything in between. We are a small but growing team with broad scope, high trust, and the…
Senior Security Operations Engineer (1 Yr Fixed Term)
League
Toronto, ON
$130,600 to $170,000 CAD / year
Contract
…accept and encourage applicants who have existing software engineering experience and want to explore security and applicants who may have done a security program in a post-secondary…
Senior Security Operations Engineer - 1 year Fixed Term
League Inc.
Toronto, ON
…accept and encourage applicants who have existing software engineering experience and want to explore security and applicants who may have done a security program in a post-secondary…
Senior AI Security Automation Engineer
State Street
Toronto, ON
Full-time
State Street's Cyber Data & Analytics (CyberDNA) team is seeking a Senior AI Security Automation Engineer to help shape the next generation of cybersecurity data, analytics, and AI-powered…
Lead AI Security Automation Engineer
State Street
Toronto, ON
Full-time
State Street's Cyber Data & Analytics (CyberDNA) team is seeking a Lead AI Security Automation Engineer to shape the next generation of cybersecurity data, analytics, and AI-powered…
Threat Research Software Engineer (m/f/n)
ESET
Montreal, QC
Full-time
…accelerate development backed by sound planning and to power researcher-facing features (report generation, structured extraction), with strong judgment about validation, code quality and…
Senior Security Operations Engineer
Brex
Vancouver, British Columbia
Engineering at Brex is about building systems that scale with speed and intention. Our teams span Software, Data, Security, and IT, and operate with high autonomy and deep collaboration. We…
Développeur logiciel en support à la recherche sur les menaces / Threat Research Software Engineer (m/f/n)
ESET
Montreal, QC
Full-time
ESET Research est une équipe de plus de 30 chercheurs qui analyse des opérations complexes de cyberespionnage et de cybercriminalité. Nous travaillons en collaboration avec d’autres équipes…
Added 1 day ago
Lead Product Engineer (Global Security)
RBC
Toronto, ON
Full-time
Define AppSec Strategy – Own the AppSec roadmap for DevSecOps and Security Controls, prioritizing initiatives that deliver measurable value to development teams
Added 1 day ago
Lead Product Engineer (Global Security)
Royal Bank of Canada
Toronto, ON
Full-time
Define AppSec Strategy – Own the AppSec roadmap for DevSecOps and Security Controls, prioritizing initiatives that deliver measurable value to development teams
Cloud Security Lead
Deloitte
Canada
Full-time
We are seeking a hands on Cloud Security Lead who excels at deep technical analysis, research, and practical execution across cloud platforms. This role is for a technical practitioner who…
Distinguished Engineer, AI Threat Defense
Thomson Reuters
Toronto, ON
Full-time
This is a highly influential, hands-on technical role with no direct reports. You will lead through engineering depth, sound judgment, architecture, collaboration, and mentorship - working…
Added 6 hours ago
Senior Security Operations Specialist
CDW
Mississauga, ON
Full-time
The Sr. Specialist – Managed Security Services continues second-level technical client support provided by the Analyst and Sr. Analysts. The Sr. Specialist has proven process experience in…
ML Engineer
Tigera
Vancouver, BC
…infrastructure faster than platform teams can identify them and security teams can govern them. The technical surface is new - agents make decisions, call tools, hold credentials, and reach…
Added 1 day ago
Senior AI Engineer
Tundra Technical Solutions
Toronto, ON
$80 to $88 CAD / hour
Contract
We are looking for a Senior AI / Generative AI Engineer to design, build, and scale production-grade AI systems and intelligent agents, integrating advanced AI capabilities into enterprise…
Chief Software Engineering Architect
DataStealth
Mississauga, ON
Full-time
You're the most senior technical mind in the company - a hands-on architect who still writes code, still ships, and still de-risks the hardest problems personally. You set the technical…
Senior Penetration Tester & Red Team Engineer
Cognizant
Toronto, ON
Full-time
· Support security engineering initiatives by solving complex technical challenges requiring both development and cybersecurity expertise.
AI Application Security Architect
ACV
Toronto, ON
Advise engineering and security leadership on multi-year AI security strategy, and partner with AI governance to translate policy into enforceable technical controls.
Lead Penetration Test Engineer
S&P Global
Toronto, Ontario
$135,000 to $180,000 CAD / year
Full-time
We are seeking a Lead Penetration Test Engineer with extensive experience in penetration testing and offensive security. The ideal candidate will conduct penetration tests, re-testing,…
Cybersecurity Incident Response Commander
ISA Cybersecurity
Toronto, ON
Full-time
The Cybersecurity Incident Response (IR) Commander is the technical and operational authority for ISA Cybersecurity's Digital Forensics & Incident Response (DFIR) function and holds…
Software Engineer II - Agentic AI Foundations
Socure
Toronto, ON
$135,000 to $175,000 CAD / year
Full-time
Experience with AI safety, security, or policy systems - including guardrails, policy engines, content filters, or responsible AI frameworks - through professional work, research,…
Staff Software Engineer, Backend
Okta
Toronto, ON
$160,000 to $220,000 CAD / year
Full-time
We are seeking a highly impactful and influential Staff Software Engineer to join our engineering team. The ideal candidate will leverage their deep expertise in distributed systems,…
Staff Software Engineer, Backend
Okta
Toronto, ON
We are seeking a highly impactful and influential Staff Software Engineer to join our engineering team. The ideal candidate will leverage their deep expertise in distributed systems,…
Network Services Supervisor, Permanent Full time
The Corporation of UCLG
Brockville, ON
Full-time
Microsoft 365 Certified: Enterprise Administrator, Microsoft Certified Systems Engineer (Retired), Certified Information Systems Security Professional (CISSP) or equivalent is required.

ISA Cybersecurity

Cybersecurity Incident Response Commander

Toronto, ON, M8X 2X3, Canada

Pay: Salary Range: $135,000-$157,500- $180,000
Job type: Full-time

Apply About employer

Applications open in a new tab.

At a glance

Automatically prepared from the listing. Check the original description for the full requirements.

Jump to the original description

Responsibilities

Serve as the technical and operational authority for Digital Forensics and Incident Response engagements, leading the response to high-severity cyber incidents. Develop and refine DFIR processes and playbooks while acting as a trusted advisor to client executives and boards.

Requirements

Requires 10+ years of cybersecurity experience with at least 7 years in DFIR and a mandatory CISSP certification. Must have demonstrated experience commanding complex engagements like ransomware and APT intrusions across multi-cloud environments.

Experience

10+ years

Education

bachelor degree
professional certificate

Working hours

40 hours per week

Work arrangement

Hybrid

Days in the office

Skills

Incident Command
Digital Forensics
Ransomware Response
Cloud Forensics
Threat Intelligence
Stakeholder Management
Executive Communication
OSINT
MITRE ATT&CK
Chain-of-Custody
EDR/SIEM/SOAR
NIST SP 800-61

Benefits

Flexible Sick And Personal Days
Health Plan
Mental Health Resources
Professional Development Opportunities
Education Reimbursement
Maternity And Parental Leave Top-up
Employee Referral Bonus
RRSP Matching
Bonus Programs
Distance Remote Working Policy
LinkedIn Learning Access
Service Anniversary Recognition
President's Club Awards
Spot Rewards

Visa sponsorship

Not detected in the job text

Keywords

Cybersecurity
Incident Response
DFIR
CISSP
GCIH
GCFA
GCIA
GX-FA
GSE
OSCP
CISM
CCSP
EnCE
CHFI
ECIH
AWS Security
Azure Security
Google Cloud Security
Ransomware
BEC
APT
MITRE ATT&CK
NIST CSF
ISO 27001
SOC 2
OSINT
EDR
SIEM
SOAR
NDR

Original job description

About the Role:

The Cybersecurity Incident Response (IR) Commander is the technical and operational authority for ISA Cybersecurity's Digital Forensics & Incident Response (DFIR) function and holds expert-level command of the Security Incident Response (SIR) service during client engagements. The role is structured as a Subject Matter Expert and Incident Commander rather than a line-management position: technical authority, judgment under pressure, and external-grade SME presence are the primary contributions.

The IR Commander leads the Response side of ISA's Protect-Detect-Respond operating model through influence, process and playbook ownership, and direct command on every Emergency and IR Retainer engagement. People-leadership behaviors including coaching analysts, championing career pathways, and modelling composure under stress are valued and expected to grow over time, but formal direct reports are not a requirement of the role at hire. Development and ongoing evolution of the Incident Response program is subject to the final authority of the Senior Director, DFIR Services who provides strategic direction and ultimate accountability for the program's scope, structure, and priorities.

This role reports to the Senior Director, DFIR Services. The successful candidate will have extensive experience in personally commanding and leading ransomware, business email compromise, data exfiltration, and complex multi-vector engagements, and will be recognized externally as a subject-matter expert in incident response and digital forensics.

About Us:

We are proud to be recognized as a top employer for multiple years in a row, we currently hold the distinctions of Canada’s Top Small and Medium Employers 2025, Greater Toronto’s Top Employers 2025 and are Certified Great Place to Work 2026-2027.

ISA Cybersecurity is a proudly Canadian cyber and AI services and solutions provider. Trusted by over 500 clients from SMB to global enterprise, we empower organizations to safeguard their most critical assets and adopt AI securely. Through our highly customizable Cyber 360 and AI 360 offerings, we deliver a comprehensive range of governance, assurance, engineering protection, detection, and response services for the public and private sectors. Backed by over three decades of operational experience and a vast network of highly specialized and certified experts, we leverage cutting-edge technologies and AI to ensure that clients achieve their privacy, security, and business goals.

We operate in a remote-first environment. Office presence is typically less than 20% of the time, varying by role and work requirements. Our office space, located at Bloor and Islington, is a collaborative space designed for in-person meetings and drop-ins. We enjoy hosting in-person quarterly townhalls and social events throughout the year to encourage teambuilding and collaboration.

Responsibilities:

Serve as Incident Commander for all IR Retainer engagements and Emergency IRs delivered by ISA Cybersecurity.
Lead digital forensic investigations across endpoint, server, network, mobile, and cloud sources.
Ensure chain-of-custody discipline suitable for legal proceedings.
Develop, manage, and continuously refine DFIR processes, procedures, playbooks, and runbooks (DFIR policy authorship is out of scope and sits with other functions).
Conduct regular reviews and updates to DFIR people, processes, and technologies to ensure alignment with organizational objectives and the evolving threat landscape.
Present incident and digital evidence reports to key stakeholders including law enforcement, legal counsel, and clients; Lead post-incident reporting and client walk-throughs and translate lessons learned into process, playbook, tooling, and training improvements.
Educate internal and external stakeholders on incident identification and response best practices.
Support presales activities including proposals, Statements of Work (SOWs), and RFP responses.
Own the technical quality of the DFIR practice in alignment with the Security Incident Response (SIR) service card.
Integrate threat intelligence into incident analysis and feed TTPs back into detection content and hunting hypotheses.
Identify, define, track, and report on DFIR metrics; run continuous-improvement cycles against them to drive service-quality and operational outcomes.
Lead and manage the IR readiness program including IR Plan engagements, Tabletop Exercises (TTX), and Playbook development and/or validation.
Serve as a senior client-facing voice during engagements and a trusted advisor between them; brief executives, boards, regulators, legal counsel, and law enforcement as required.
Represent ISA externally as a recognized DFIR subject matter expert - publications, speaking engagements, industry forums, IR community participation, etc.
Collaborate closely with SOC leadership, analysts, and Service Owners to ensure incident response remains tightly integrated with detection capabilities and aligned to the broader evolution of ISA's service portfolio.
Coach DFIR analysts and Incident Managers through technical authority, case-based pairing, and matrix influence; participate in hiring panels and rotation planning.

Qualifications:

10+ years of progressive experience in cybersecurity, with at least 7 years in incident response and digital forensics roles.
Demonstrated experience as Incident Commander on multiple high-severity engagements (e.g., ransomware, BEC, APT intrusion, large-scale data breach).
Expert-level knowledge of the incident response lifecycle, containment and eradication strategies, and digital forensic methodologies.
Hands-on expertise across host, network, memory, mobile, and cloud forensics, including chain-of-custody discipline suitable for legal proceedings.
Proficient working with Windows, Linux, and MacOS
Experience with multi-cloud forensics (AWS, Azure, GCP, Microsoft 365, Google Workspace) and SaaS-platform investigations.
Experience with OSINT (Open-Source Intelligence), including gathering and correlating publicly available information to support threat actor attribution, infrastructure mapping, and exposure analysis, and translating findings into actionable intelligence for client engagements.
Working knowledge of multiple security control families such as EDR, SIEM, SOAR, NDR, identity, email security, DLP, and their use during response.
Deep familiarity with MITRE ATT&CK and current ransomware/APT TTPs.
Working knowledge of NIST SP 800-61, ISO 27035, ISO 27001:2022, NIST CSF, SOC 2, and CSA CCM.
Demonstrated ability to identify, define, track, and report on operational and service-quality metrics, and to run continuous-improvement cycles against them.
Excellent leadership-by-influence, executive communication, and stakeholder management skills; must be able to communicate clearly under pressure and to non-technical audiences.
Trusted advisor presence; ability to brief client executives and boards on cyber risk, governance, and resilience between as well as during incidents.
Bachelor’s degree in computer science, Information Security, or related field, or equivalent professional experience.
CISSP (required).
Willingness to participate in 24x7 on-call rotation for IR Retainers and Emergency IRs.
Ability to obtain Government of Canada security clearance.
Strong English language skills, written and verbal.

Nice to Have

People leadership experience including coaching, mentoring, performance feedback, hiring panels, even where the role has not formally carried direct reports.
Experience leading or contributing to MSSP service delivery including contractual SLAs, RACI models, 24x7 operations, and onboarding/transition workflows.
Recognized externally as a subject matter expert through published research, conference talks, MITRE ATT&CK contributions, media commentary, or industry awards.
Experience supporting law enforcement engagements (RCMP NC3, CCCS/CCIRC, FBI Cyber), Anton Piller orders, expert witness testimony, or regulatory investigations.
Experience with dark web monitoring and social-media threat monitoring.
Multilingual capability is an asset.

Certifications

Required: CISSP
Strongly preferred: GCIH, GCFA, GCIA, GX-FA, GSE
Preferred: OSCP, CISM, CCSP, EnCE, CHFI, ECIH
Cloud (any of): AWS Security Specialty, Azure Security Engineer, Google Professional Cloud Security Engineer

Why Join Us?

At ISA Cybersecurity we lead with our "Why". Our Why is to make people feel safe. This not only applies to the result of services that we provide to our clients, but how people feel when interacting with us. Whether you're an employee of ISA or a client we want you to feel safe and supported. Each one of our team members is expected to uphold this leadership quality and embrace it through consistent demonstration of our core values of Explore, Persevere, Adapt and Uplift.

We are proud to offer a variety of employee friendly programs that enable our team to perform at their best.

Highlights of our programs and policies include:

Flexible sick and personal days for all employees
Generous health plan with enhanced mental health resources and programs
Professional development opportunities and education reimbursement up to $2,000 annually for all employees
Maternity and parental leave top-up
Employee referral bonus of $2,000
Competitive salaries complemented with RRSP matching and bonus programs
Distance remote working policy
LinkedIn Learning access for all team members

We also place great value on celebrating the contributions of all employees through the following service recognition programs:

Service anniversary recognition and generous five-year milestone service awards
President’s Club recognizing special achievement awards: Team Member of the Year for Sales, CIOC and Cyber Services, the Rich Uhrich Founder’s Award that is nominated on by all employees and four President’s Awards (Risk Taker, Lost Without You, Money Maker and On the Rise)
Spot rewards providing opportunities for instant peer recognition

Information-sharing and team-building initiatives include:

Annual kick-off meeting to communicate our strategic priorities
Quarterly town hall meetings
Regular team get togethers and client events
Scheduled employee feedback surveys and goal setting focus groups

Thank you for your interest in joining ISA Cybersecurity. Our team looks forward to reviewing your application. We will be reaching out to you directly if your experience matches our needs.

Vacancy Status: This posting is for an existing vacancy. Salary Range: $135,000-$157,500- $180,000

AI Disclosure: ISA Cybersecurity does not currently use artificial intelligence tools as part of our recruitment process.

Accessibility:

ISA Cybersecurity is committed to providing accommodations for applicants with disabilities. If you require specific accommodation because of a disability or medical need, please inform ISAs Human Resources team ([email protected]) so arrangements can be made for appropriate accommodation to be in place during the recruitment process.

Apply About employer

Report this job