Sr. Cyber Consultant, DFIR
LevelBlue
Canada
The Role
This senior consulting position sits within a global DFIR practice and involves leading end-to-end incident response engagements — from identification and containment through to eradication and recovery. Day-to-day work includes forensic examination of servers, workstations and SaaS platforms, evidence preservation, log analysis, and authoring detailed narrative reports for both technical and non-technical audiences.
Skills & Experience
Candidates should bring proven DFIR experience and hands-on proficiency with forensic tooling such as X-Ways. Familiarity with IR frameworks (NIST, SANS), cloud platforms (Azure, AWS, GCP, Oracle), network protocols, and scripting languages such as Python or PowerShell is valued. Industry-recognised DFIR certifications are preferred alongside strong written and verbal communication skills.
Who It Suits
This role suits an experienced DFIR professional who is comfortable working independently against engagement milestones, managing multiple concurrent cases, and collaborating with client-side legal, IT and compliance teams. Those who thrive under pressure in a consulting environment and can communicate complex findings to non-technical audiences will excel here.
Typical advertised salary for Incident Response roles in Canada: C$95,000–C$162,000 (median C$130,000 — from 51 recent listings analysed by Forensic Focus).
Compare Incident Response salaries in Canada →
Certifications mentioned: SANS — find training for these on the DFIR Training Finder.
