Cybersecurity Analyst / IR - Incident Response

Location**:** Vaughan, ON (GTA) Employment Type: Full-time / Permanent / Contract

Cyberwall is a cybersecurity services provider delivering advanced threat detection, digital forensics, and incident response services to organizations across Canada.

We are seeking a skilled and experienced Cybersecurity Analyst to join our growing security team in Vaughan.

This role is ideal for a hands-on cybersecurity professional with strong investigative experience who can lead threat huntin, incident handling, perform deep technical analysis, and guide clients through containment and remediation efforts.

Key Responsibilities

• Lead and coordinate incident response activities across client environments
• Perform advanced investigation and analysis of security incidents, including malware outbreaks, ransomware, insider threats, and advanced persistent threats (APTs)
• Conduct host-based and network-based forensic investigations
• Analyze EDR/XDR telemetry, firewall logs, SIEM data, and cloud security alerts
• Develop containment, eradication, and recovery strategies
• Provide root cause analysis and detailed post-incident reporting
• Support proactive threat hunting initiatives
• Identify gaps in detection capabilities and recommend improvements
• Collaborate with SOC, engineering, and client IT teams during active incidents
• Assist in developing and refining incident response playbooks and procedures
• Stay current with emerging threats, attack techniques, and vulnerability trends

Technical Requirements

• Strong experience with EDR/XDR platforms (SentinelOne or similar)
• Hands-on experience with SIEM platforms and log correlation
• Experience investigating Windows, Linux, and cloud-based environments
• Solid understanding of network protocols (TCP/IP, DNS, VPNs) and network security architecture
• Experience with firewall and IPS technologies
• Knowledge of MITRE ATT&CK framework and attacker tactics, techniques, and procedures (TTPs)
• Familiarity with forensic tools and methodologies
• Ability to analyze logs in formats such as JSON, Syslog, and CEF
• Scripting capability (PowerShell, Python, or similar) is an asset

Qualifications

• 3+ years of experience in cybersecurity, with strong focus on Threat hunting and Incident Response
• Experience in MSSP, SOC, consulting, or enterprise security environments
• Demonstrated experience handling real-world security incidents end-to-end
• Strong knowledge of security frameworks (NIST, ISO 27001, CIS Controls)
• Experience with ransomware investigations and containment strategies
• Excellent analytical, documentation, and communication skills
• Ability to remain composed and decisive during high-severity incidents

What We Offer

• Opportunity to work on complex, real-world security incidents
• Exposure to diverse client environments and advanced threat scenarios
• Growth opportunities within a rapidly expanding cybersecurity firm
• Collaborative and technically driven team environment

Location Requirement

• GTA local candidates only,
• Onsite role in Vaughan, ON