Cybersecurity Incident Response Manager
Cybersecurity Incident Response Manager
Our client is a leading insurance company.
Location is Markham - GTA, Toronto Area, Ontario (Occasional need to go to Downtown Toronto)
Hybrid - 2-3 days in office per week. Likely to increase in 2025
This a perm/FT role.
Salary + bonus + pension + benefits.
Client is looking for a technical Cybersecurity Incident Response Manager to join Cybersecurity department. In this role you will act as a Cybersecurity Incident Response manager and advisor. You will be joining and managing a team of Cybersecurity analysts and act as a liaison between various teams, business partners and technical teams such as Global SOC, Data Loss Prevention, Compliance, Threat Intelligence, Vulnerability and Risk Management, Governance, Identity and Access Management, Systems and Network Engineering, Software Development, 3rd Party Vendors/Suppliers, HR, Legal, etc.
The ideal candidate has strong SIEM, endpoint detection / prevention and data loss prevention and Cloud, AWS preferred and also possesses a broad knowledge of information security systems and solid skills in Incident Response, Networking, Programming, and System Administration. This person should have a background in many domains of IT, but a strong ability and interest in learning and championing Cybersecurity.
What you’ll do:
In this role, you will be responsible for:
• Managing a team of Incident responders and Threat Hunters (approx 4 members)
• Defining and maintaining Information Security Incident Management Process and create procedure documents for incidents handling
• Performing forensics investigation based on logs and other data. Validate containment and remediation measures, Perform Root Cause Analysis (RCA) as necessary.
• Managing, maintaining and enhancing Incident Response capabilities to detect, proactively hunt for and respond to advanced cyberattacks
• Coordinating, monitoring, and supporting general activities related to cases, investigations and risk mitigation and analysis
• Coordinating, communicating, sharing information, and working closely with various business units and teams within the company
• Periodically conducting tabletop exercises to test the readiness of IR function
• Working closely with Cybersecurity Engineering team on new monitoring rules implementation, playbooks, and other manual tasks automation
• Researching emerging threats to gain insight and understanding of the evolving threat landscape and its impact to company
• Ensuring continuous improvement of Cybersecurity posture
What you’ll bring:
• 5+ years of hands-on experience in Cybersecurity, InfoSec, Security Engineering, Network Engineering with emphasis in Incident Response, Threat Hunting, and Cyber Security Operations
• Knowledge in the following Cybersecurity domains:
• Securing infrastructure in public clouds (AWS, Azure, GCP, etc.)
• SIEM, Log Management, Network Security & Monitoring
• Endpoint detection protection and response
• Cryptographic services
• Computer Forensics
• Vulnerability Management
• SOAR and playbooks automation
• IAM/PAM
• Intrusion Detection and Prevention
• Data Loss Prevention
• Threat Intelligence and UEBA
• Excellent problems solving skills, ability to coordinate with different local and global teams
• Ability to move quickly in a fast-paced and fluid environment, as well as influence peers and partners to prioritize issues as needed
• High proficiency in creating and presenting incident summary reports
• Familiarity with security frameworks such as NIST, PCI and CIS
• Ability to plan, organize and prioritize tasks to complete within established time frames
• Ability to work independently without direct supervision, self-motivated, and meet tight deadlines
• Outstanding technical skills, knowledge of network protocols and network communication principles, understanding of vulnerabilities and remediation techniques
• Excellent written, verbal, and interpersonal skills
• Continuous improvement attitude
• Professional and courteous in all interactions
• Able to influence, innovate and drive Cybersecurity standard methodologies
• Experience in AWS and Azure is a plus
• BS Degree in Computer Science/Engineering, Information Security/Technology or in a related technical field or equivalent practical experience
• At least one standard industry certification such as GSEC, CISA/CISM/ CISSP/CSCS/CEH or equivalent certifications
Our client is a leading insurance company.
Location is Markham - GTA, Toronto Area, Ontario (Occasional need to go to Downtown Toronto)
Hybrid - 2-3 days in office per week. Likely to increase in 2025
This a perm/FT role.
Salary + bonus + pension + benefits.
Client is looking for a technical Cybersecurity Incident Response Manager to join Cybersecurity department. In this role you will act as a Cybersecurity Incident Response manager and advisor. You will be joining and managing a team of Cybersecurity analysts and act as a liaison between various teams, business partners and technical teams such as Global SOC, Data Loss Prevention, Compliance, Threat Intelligence, Vulnerability and Risk Management, Governance, Identity and Access Management, Systems and Network Engineering, Software Development, 3rd Party Vendors/Suppliers, HR, Legal, etc.
The ideal candidate has strong SIEM, endpoint detection / prevention and data loss prevention and Cloud, AWS preferred and also possesses a broad knowledge of information security systems and solid skills in Incident Response, Networking, Programming, and System Administration. This person should have a background in many domains of IT, but a strong ability and interest in learning and championing Cybersecurity.
What you’ll do:
In this role, you will be responsible for:
• Managing a team of Incident responders and Threat Hunters (approx 4 members)
• Defining and maintaining Information Security Incident Management Process and create procedure documents for incidents handling
• Performing forensics investigation based on logs and other data. Validate containment and remediation measures, Perform Root Cause Analysis (RCA) as necessary.
• Managing, maintaining and enhancing Incident Response capabilities to detect, proactively hunt for and respond to advanced cyberattacks
• Coordinating, monitoring, and supporting general activities related to cases, investigations and risk mitigation and analysis
• Coordinating, communicating, sharing information, and working closely with various business units and teams within the company
• Periodically conducting tabletop exercises to test the readiness of IR function
• Working closely with Cybersecurity Engineering team on new monitoring rules implementation, playbooks, and other manual tasks automation
• Researching emerging threats to gain insight and understanding of the evolving threat landscape and its impact to company
• Ensuring continuous improvement of Cybersecurity posture
What you’ll bring:
• 5+ years of hands-on experience in Cybersecurity, InfoSec, Security Engineering, Network Engineering with emphasis in Incident Response, Threat Hunting, and Cyber Security Operations
• Knowledge in the following Cybersecurity domains:
• Securing infrastructure in public clouds (AWS, Azure, GCP, etc.)
• SIEM, Log Management, Network Security & Monitoring
• Endpoint detection protection and response
• Cryptographic services
• Computer Forensics
• Vulnerability Management
• SOAR and playbooks automation
• IAM/PAM
• Intrusion Detection and Prevention
• Data Loss Prevention
• Threat Intelligence and UEBA
• Excellent problems solving skills, ability to coordinate with different local and global teams
• Ability to move quickly in a fast-paced and fluid environment, as well as influence peers and partners to prioritize issues as needed
• High proficiency in creating and presenting incident summary reports
• Familiarity with security frameworks such as NIST, PCI and CIS
• Ability to plan, organize and prioritize tasks to complete within established time frames
• Ability to work independently without direct supervision, self-motivated, and meet tight deadlines
• Outstanding technical skills, knowledge of network protocols and network communication principles, understanding of vulnerabilities and remediation techniques
• Excellent written, verbal, and interpersonal skills
• Continuous improvement attitude
• Professional and courteous in all interactions
• Able to influence, innovate and drive Cybersecurity standard methodologies
• Experience in AWS and Azure is a plus
• BS Degree in Computer Science/Engineering, Information Security/Technology or in a related technical field or equivalent practical experience
• At least one standard industry certification such as GSEC, CISA/CISM/ CISSP/CSCS/CEH or equivalent certifications
Job Title
Cybersecurity Incident Response Manager
Cybersecurity Incident Response Manager
Job Type
Full-Time Regular
Full-Time Regular
Location
Markham ON
Markham ON
Country
CANADA
CANADA