Senior Specialist, Cyber Response and Digital Investigation

At KPMG, you’ll join a team of diverse and dedicated problem solvers, connected by a common cause: turning insight into opportunity for clients and communities around the world.

As a Senior Cyber Response and Digital Investigation Specialist at KPMG Canada, your primary role will be to participate in the investigation and resolution of proven cyber incidents. You will be responsible for analyzing and investigating evidence, gathering digital evidence for analysis, and deploying tools for analysis and investigation. You will be called upon to investigate security incidents, data breaches and suspicious activities. You will use specialized tools and techniques to collect, analyze and present digital evidence as part of legal proceedings or internal investigations.

Comprising several multidisciplinary experts, the team's day-to-day focus on incident response and digital forensics is its sole area of expertise. It enjoys international recognition for both the depth of its expertise and its unique ability to respond to all facets of an incident.

• Lead and manage computer forensic investigations and cyber incident response, including log analysis, malware triage and binary reverse engineering.
• Collect, analyze, and maintain data to support investigation, risk management and mitigation efforts.
• Demonstrate in-depth technical knowledge in the areas of operating system security, network security, cryptography and malware analysis.
• Perform computer forensics analysis on various platforms using tools such as EnCase, Autopsy, Magnet Axiom and Cellebrite.
• Use and analyze the results of endpoint detection and response (EDR) tools such as Sentinel One and Microsoft Defender.
• Develop incident investigation and computer forensics reports.
• Communicate effectively at various levels and audiences.
• Participate in regular on-call responsibilities.
• Contribute to thought leadership and business development campaigns.
• Promote a culture of sharing and collaboration within the team.

• Undergraduate degree in Computer Science, Information Technology or related field - or equivalent in academics and/or experience.

• A minimum of three (3) years prior experience in incident response or CSIRT is preferred.

• Hands-on experience with various security tools, including log management, web proxies, endpoint protection platforms, etc. is preferred.

• Completion of relevant certifications such as GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Examiner (GCFE), EnCase Certified Examiner (EnCE), CCFP ISC(2) or similar.

• Minimum of two (2) years' experience using forensic software applications (e.g. EnCase, FTK, Autopsy, Magnet Axiom, Cellebrite, Wireshark, OpenVAS, Snort, Magnet IEF/Axiom) and techniques to capture electronic data from computers, external media, networks and mobile devices.

• Experience in consulting or external consulting capacity or as an incident response manager in a company or firm will be a plus.
• Practical experience in computer forensics such as Windows, Unix and/or Linux disk and memory forensics, host and network based security monitoring, traffic and log analysis and static and dynamic malware analysis in support of incident response investigations and potential litigation with an understanding of evidence management procedures.

Additional information:

• The selected expert understands that he/she will be on call 1 week out of 4, including evenings, nights and weekends. In the event of an incident outside working hours, the expert must be available within one hour of contact (bonus offered). A cell phone can be provided on request.
• The expert understands that he/she is joining an incident response team, and that hours may vary in times of high demand.

Providing you with the support you need to be at your best

For more information about KPMG in Canada’s Benefits and well-being, click here.

Integrity, we do what is right | Excellence, we never stop learning and improving | Courage, we think and act boldly | Together, we respect each other and draw strength from our differences | For Better, we do what matters

KPMG in Canada is a proud equal opportunities employer and we are committed to creating a respectful, inclusive and barrier-free workplace that allows all of our people to reach their full potential. A diverse workforce is key to our success and we believe in bringing your whole self to work. We welcome all qualified candidates to apply and hope you will choose KPMG in Canada as your employer of choice. For more information about Inclusion, Diversity & Equity in Recruitment, please click here.

Adjustments and accommodations throughout the recruitment process

At KPMG, we strive for an inclusive recruitment process that allows all candidates to Come As You Are and Thrive with Us. We aim to provide a positive experience and are ready to offer adjustments or accommodations to help you perform at your best. Adjustments (an informal request), i.e. extra preparation time or the option for micro breaks during interviews, and accommodations (a formal request), i.e. accessible communication supports or technology aids are tailored to individual needs and role requirements.

To begin a confidential conversation about adjustments or accommodations at any point throughout the recruitment process, we encourage you to contact KPMG’s Employee Relations Service team for support by emailing cdnersteam@kpmg.ca or by calling 1-888-466-4778, Option 3.

For information about accessible employment at KPMG, please visit our accessibility page.