Cybersecurity Incident Investigator

Location: Fully remote from Canada; must be legally authorized to work in Canada and hold or be eligible to obtain and maintain Government of Canada Security Clearance Level 2 (Secret / Protected B). Regular collaboration spans Canadian time zones and stakeholders in other Canadian provinces, the United States, and internationally.

Salary: $118,700–$168,700 CAD

Company

hirify.global runs and reimagines mission-critical technology systems and provides IT and security solutions for leading businesses.

What you will do

• Conduct end-to-end cybersecurity investigations across cloud, identity, and hybrid enterprise environments.
• Investigate advanced threats including malware, ransomware, credential theft, business email compromise, insider threats, and potential data exposure.
• Analyze evidence across multiple platforms to build attack timelines, identify initial access vectors, determine root cause, and assess impact.
• Evaluate business risk, regulatory implications, and confidentiality impact alongside technical severity.
• Contain and resolve complex security events and provide actionable recommendations to leadership.
• Produce executive-ready investigation reports and brief technical and non-technical stakeholders during high-severity incidents.

Requirements

• Must hold, or be strictly eligible to obtain and maintain, Government of Canada Security Clearance Level 2 (Secret / Protected B).
• Must be legally authorized to work in Canada.
• Hands-on experience in cybersecurity incident response, digital forensics, or complex end-to-end security investigations; basic alert triage alone is insufficient.
• Strong expertise with Microsoft Entra ID (Azure AD), Active Directory, identity and access architectures, and hybrid cloud security.
• Experience analyzing SIEM telemetry, forensic artifacts, network data, and operating system internals across Windows and Linux.
• Ability to establish defensible attack timelines, identify initial access vectors, and determine root cause.
• Experience assessing business risk, regulatory implications, and confidentiality impact.
• Ability to produce clear executive-ready reports and brief non-technical stakeholders.
• Ability to work autonomously in a remote, distributed team across Canadian time zones; English is required and fluency in French is required.

Nice to have

• GIAC GCFE, GCFA, GCIH, GNFA, CISSP, or other relevant industry certifications.
• Experience with Velociraptor, FTK, EnCase, Volatility, KAPE, enterprise forensic tooling, and modern EDR/XDR platforms.
• Practical threat intelligence experience and attacker-behavior mapping with MITRE ATT&CK.

Culture & Benefits

• Flexible remote work environment supporting well-being and professional growth.
• Financial, mental, physical, and social health support through Be Well programs.
• Personalized development goals, continuous feedback, coaching, and hands-on learning.
• Access to certification and learning opportunities involving Microsoft, Google, and Amazon.
• Collaborative culture centered on empathy, inclusion, belonging, continuous learning, and shared success.

Hiring process

• If referred by a hirify.global employee, select “Employee Referral” and enter the contact’s hirify.global email address when asked how the application was discovered.