DFIR Manager

Job summary

Lead complex DFIR engagements from triage through investigation, containment, remediation, and closure, while conducting and overseeing hands-on forensic analysis. Advise clients and executive stakeholders, develop response strategies and reporting, support incident response planning, and mentor responders across a global team.

Job details

DFIR Manager – Canada Remote | Canada | CAD $140,000–$170,000 + Benefits We’re partnering with a global cybersecurity and digital forensics business that is continuing to strengthen its incident response capability across Canada. They’re looking for an experienced DFIR Manager who can lead complex cyber incidents end-to-end while remaining genuinely hands-on technically. This is not a purely managerial position. The successful candidate will be expected to stay close to live investigations, guide technical strategy, support clients through high-pressure incidents and mentor other responders across the team. The Role You’ll take ownership of high-severity cyber incidents from initial triage through containment, investigation, remediation and closure. Typical engagements may include: Ransomware Business Email Compromise (BEC) Advanced intrusions Endpoint investigations Cloud compromise Insider threat Data breaches Network-based incidents You’ll also act as a senior technical point of contact for clients, working closely with executive stakeholders, legal teams, breach counsel and other external parties throughout the response process. What You’ll Be Doing Lead complex DFIR and incident response engagements Perform and oversee hands-on forensic investigations Analyse endpoint, network and cloud evidence Identify attacker activity, IOCs and root cause Develop containment, eradication and remediation strategies Work across EDR/XDR, SIEM and forensic tooling Produce clear technical and executive-level reporting Support incident response plans, playbooks and tabletop exercises Mentor and develop DFIR analysts and responders Act as a trusted technical advisor throughout client engagements Support a global follow-the-sun incident response model What We’re Looking For You’ll ideally bring: 6+ years of incident response / DFIR experience Strong hands-on digital forensics capability Previous experience working in consulting, professional services or external client-facing incident response Experience leading ransomware, BEC or major breach investigations Strong understanding of endpoint, network and cloud forensics Experience with EDR/XDR platforms such as CrowdStrike, SentinelOne, Microsoft Defender or Carbon Black Experience working with SIEM platforms and security telemetry Knowledge of evidence handling and chain of custody Strong understanding of incident response frameworks such as NIST Experience leading or mentoring technical teams Strong client communication skills, including senior stakeholders Exposure to cyber insurance, legal counsel or breach response ecosystems would be highly advantageous French language skills are also beneficial but not essential. Location This role is fully remote within Canada. Candidates must have the legal right to work in Canada. Some occasional travel and participation in an on-call / incident response rota may be required. Compensation CAD $140,000–$170,000 base salary, depending on experience, plus benefits. Why This Role? This is an opportunity to join a highly experienced international DFIR team where you can combine technical investigation, client leadership and team development without moving away from the hands-on work. If you’re an experienced incident responder who still enjoys getting into the detail of complex investigations but also wants broader ownership across clients, people and strategy, this could be a very strong fit. Apply directly or message me confidentially for more information.

What you’ll do

Lead complex DFIR engagements from triage through investigation, containment, remediation, and closure, while conducting and overseeing hands-on forensic analysis. Advise clients and executive stakeholders, develop response strategies and reporting, support incident response planning, and mentor responders across a global team.

Requirements

Candidates should have 6+ years of DFIR or incident response experience, strong hands-on forensic capabilities, and experience leading major investigations in a consulting or client-facing environment. They should be familiar with endpoint, network, and cloud forensics, EDR/XDR and SIEM platforms, evidence handling, incident response frameworks, and technical team leadership.

Listed skills

• Technical · Preferred
• Client · Preferred
• Reporting · Preferred
• Planning · Preferred
• Teams · Preferred
• Communication · Preferred
• Communication Skills · Preferred
• Custody · Preferred
• Development · Preferred
• email · Preferred
• French · Preferred
• Leadership · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• Digital Forensics
• Incident Response
• Cyber Incident Management
• Endpoint Forensics
• Network Forensics
• Cloud Forensics
• Ransomware Investigation
• Business Email Compromise Investigation
• EDR/XDR Platforms
• SIEM Platforms
• Security Telemetry Analysis
• Evidence Handling
• Chain of Custody
• Incident Response Frameworks
• Client Communication
• Team Mentoring

Job areas

• Security & Safety
• Technology
• Management & Leadership
• Consulting