DFIR Manager

DFIR Manager – Canada

Remote | Canada | CAD $140,000–$170,000 + Benefits

We’re partnering with a global cybersecurity and digital forensics business that is continuing to strengthen its incident response capability across Canada.

They’re looking for an experienced DFIR Manager who can lead complex cyber incidents end-to-end while remaining genuinely hands-on technically.

This is not a purely managerial position. The successful candidate will be expected to stay close to live investigations, guide technical strategy, support clients through high-pressure incidents and mentor other responders across the team.

The Role

You’ll take ownership of high-severity cyber incidents from initial triage through containment, investigation, remediation and closure.

Typical engagements may include:

• Ransomware
• Business Email Compromise (BEC)
• Advanced intrusions
• Endpoint investigations
• Cloud compromise
• Insider threat
• Data breaches
• Network-based incidents

You’ll also act as a senior technical point of contact for clients, working closely with executive stakeholders, legal teams, breach counsel and other external parties throughout the response process.

What You’ll Be Doing

• Lead complex DFIR and incident response engagements
• Perform and oversee hands-on forensic investigations
• Analyse endpoint, network and cloud evidence
• Identify attacker activity, IOCs and root cause
• Develop containment, eradication and remediation strategies
• Work across EDR/XDR, SIEM and forensic tooling
• Produce clear technical and executive-level reporting
• Support incident response plans, playbooks and tabletop exercises
• Mentor and develop DFIR analysts and responders
• Act as a trusted technical advisor throughout client engagements
• Support a global follow-the-sun incident response model

What We’re Looking For

You’ll ideally bring:

• 6+ years of incident response / DFIR experience
• Strong hands-on digital forensics capability
• Previous experience working in consulting, professional services or external client-facing incident response
• Experience leading ransomware, BEC or major breach investigations
• Strong understanding of endpoint, network and cloud forensics
• Experience with EDR/XDR platforms such as CrowdStrike, SentinelOne, Microsoft Defender or Carbon Black
• Experience working with SIEM platforms and security telemetry
• Knowledge of evidence handling and chain of custody
• Strong understanding of incident response frameworks such as NIST
• Experience leading or mentoring technical teams
• Strong client communication skills, including senior stakeholders
• Exposure to cyber insurance, legal counsel or breach response ecosystems would be highly advantageous

French language skills are also beneficial but not essential.

Location

This role is fully remote within Canada .

Candidates must have the legal right to work in Canada.

Some occasional travel and participation in an on-call / incident response rota may be required.

Compensation

CAD $140,000–$170,000 base salary , depending on experience, plus benefits.

Why This Role?

This is an opportunity to join a highly experienced international DFIR team where you can combine technical investigation, client leadership and team development without moving away from the hands-on work.

If you’re an experienced incident responder who still enjoys getting into the detail of complex investigations but also wants broader ownership across clients, people and strategy, this could be a very strong fit.

Apply directly or message me confidentially for more information.