The Cybersecurity Incident Response (IR) Commander is the technical and operational authority for ISA Cybersecurity's Digital Forensics & Incident Response (DFIR) function and holds expert-level command of the Security Incident Response (SIR) service during client engagements. The role is structured as a Subject Matter Expert and Incident Commander rather than a line‑management position: technical authority, judgment under pressure, and external‑grade SME presence are the primary contributions. People‑leadership behaviors including coaching analysts, championing career pathways, and modelling composure under stress are valued and expected to grow over time, but formal direct reports are not a requirement of the role at hire.

Development and ongoing evolution of the Incident Response program is subject to the final authority of the Senior Director, DFIR Services who provides strategic direction and ultimate accountability for the program's scope, structure, and priorities. This role reports to the Senior Director, DFIR Services. The successful candidate will have extensive experience in personally commanding and leading ransomware, business email compromise, data exfiltration, and complex multi‑vector engagements, and will be recognized externally as a subject‑matter expert in incident response and digital forensics.

ISA Cybersecurity is a proudly Canadian cyber and AI services and solutions provider. Trusted by over 500 clients from SMB to global enterprise, we empower organizations to safeguard their most critical assets and adopt AI securely. Through our highly customizable Cyber 360 and AI 360 offerings, we deliver a comprehensive range of governance, assurance, engineering protection, detection, and response services for the public and private sectors.

Backed by over three decades of operational experience and a vast network of highly specialized and certified experts, we leverage cutting‑edge technologies and AI to ensure that clients achieve their privacy, security, and business goals. We operate in a remote‑first environment. Office presence is typically less than 20% of the time, varying by role and work requirements.

Our office space, located at Bloor and Islington, is a collaborative space designed for in‑person meetings and drop‑ins. We enjoy hosting in‑person quarterly townhalls and social events throughout the year to encourage team‑building and collaboration. Serve as Incident Commander for all IR Retainer engagements and Emergency IRs delivered by ISA Cybersecurity.

Lead digital forensic investigations across endpoint, server, network, mobile, and cloud sources. Ensure chain‑of‑custody discipline suitable for legal proceedings.



Develop, manage, and continuously refine DFIR processes, procedures, playbooks, and runbooks (DFIR policy authorship is out of scope and sits with other functions).

Present incident and digital evidence reports to key stakeholders including law enforcement, legal counsel, and clients; Lead post‑incident reporting and client walk‑throughs and translate lessons learned into process, playbook, tooling, and training improvements. Own the technical quality of the DFIR practice in alignment with the Security Incident Response (SIR) service card. Integrate threat intelligence into incident analysis and feed TTPs back into detection content and hunting hypotheses. run continuous‑improvement cycles against them to drive service‑quality and operational outcomes.

Serve as a senior client‑facing voice during engagements and a trusted advisor between them; brief executives, boards, regulators, legal counsel, and law enforcement as required. Represent ISA externally as a recognized DFIR subject matter expert — publications, speaking engagements, industry forums, IR community participation, etc. Coach DFIR analysts and Incident Managers through technical authority, case‑based pairing, and matrix influence; participate in hiring panels and rotation planning. 10+ years of progressive experience in cybersecurity, with at least 7 years in incident response and digital forensics roles. ransomware, BEC, APT intrusion, large‑scale data breach).

Expert‑level knowledge of the incident response lifecycle, containment and eradication strategies, and digital forensic methodologies. Hands‑on expertise across host, network, memory, mobile, and cloud forensics, including chain‑of‑custody discipline suitable for legal proceedings. Proficient working with Windows, Linux, and MacOS.

Experience with multi‑cloud forensics (AWS, Azure, GCP, Microsoft 365, Google Workspace) and SaaS‑platform investigations.

Experience with OSINT (Open‑Source Intelligence), including gathering and correlating publicly available information to support threat actor attribution, infrastructure mapping, and exposure analysis, and translating findings into actionable intelligence for client engagements. Working knowledge of multiple security control families such as EDR, SIEM, SOAR, NDR, identity,



email security, DLP, and their use during response. Demonstrated ability to identify, define, track, and report on operational and service‑quality metrics, and to run continuous‑improvement cycles against them. must be able to communicate clearly under pressure and to non‑technical audiences. ability to brief client executives and boards on cyber risk, governance, and resilience between as well as during incidents.

Bachelor’s degree in computer science, Information Security, or related field, or equivalent skilled experience. Willingness to participate in 24x7 on‑call rotation for IR Retainers and Emergency IRs. Ability to obtain Government of Canada security clearance.

Strong

English language skills, written and verbal. People leadership experience including coaching, mentoring, performance feedback, hiring panels, even where the role has not formally carried direct reports.

Experience supporting law enforcement engagements (RCMP NC3, CCCS/CCIRC, FBI Cyber), Anton Peller orders, expert witness testimony, or regulatory investigations.

Experience with dark web monitoring and social‑media threat monitoring. Multilingual capability is an asset. Cloud (any of): AWS Security Specialty, Azure Security Engineer, Google Qualified Cloud Security Engineer At ISA Cybersecurity we lead with our "Why".

Each one of our team members is expected to uphold this leadership quality and embrace it through consistent demonstration of our core values of Explore, Persevere, Adapt and Uplift. Highlights of Our Programs and Policies Flexible sick and personal days for all employees Generous health plan with enhanced mental health resources and programs Maternity and parental leave top‑up Employee referral bonus of $2,000 Competitive salaries complemented with RRSP matching and bonus programs Distance remote working policy Team Member of the Year for Sales, CIOC and Cyber Services, the Rich Uhrich Founder’s Award that is nominated on by all employees and four President’s Awards (Risk Taker, Lost Without You, Money Maker and On the Rise) Information‑Sharing and Team‑Building Initiatives Scheduled employee feedback surveys and goal setting focus groups Thank you for your interest in joining ISA Cybersecurity.

AI Disclosure: ISA Cybersecurity does not currently use artificial intelligence tools as part of our recruitment process.

Accessibility: ISA Cybersecurity is committed to providing accommodations for applicants with disabilities. If you require specific accommodation because of a disability or medical need, please inform ISA's Human Resources team (peopleoperations@e-isa.

📌 Cybersecurity Incident Response Commander (Toronto)
🏢 ISA Cybersecurity
📍 Toronto