Cybersecurity Incident Investigator

Kyndryl

. Conduct deep-dive, end-to-end cybersecurity investigations across cloud, identity, and hybrid systems .

Posted 11/11/2026full-timeRemote • CanadaMid-LevelSenior💰 CA$118,700 - CA$168,700 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in conducting comprehensive cybersecurity investigations, including incident response and digital forensics, while effectively communicating findings to both technical and non-technical stakeholders. Proficient in assessing risks and producing actionable recommendations to enhance organizational security posture.

Highest-signal resume keywords

Cybersecurity Incident ResponseDigital ForensicsMicrosoft Entra ID (Azure AD)SIEM Telemetry AnalysisGovernment of Canada Security Clearance

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cybersecurity InvestigationsRoot-Cause DeterminationThreat DetectionMalware AnalysisRansomware InvestigationCredential Theft AnalysisBusiness Email Compromise InvestigationData Exposure AssessmentAttack Timeline EstablishmentRegulatory Risk Assessment

Soft Skills

CollaborationCommunicationAutonomyBriefing StakeholdersProblem-Solving

Tools & Technologies

VelociraptorFTKEnCaseVolatilityKAPEEDR/XDR PlatformsHybrid Cloud SecurityWindows InternalsLinux InternalsForensic Artifacts Analysis

Certifications & Qualifications

GIAC GCFEGIAC GCFAGIAC GCIHGIAC GNFACISSP

Industry Keywords

CybersecurityComplianceRegulatory RisksConfidentiality RisksThreat IntelligenceMITRE ATT&CKCloud SecurityIdentity SecurityIncident ManagementDigital Asset Protection

Tech Stack

Tools & technologies

AzureCloudCyber SecurityLinux

About the role

Key responsibilities & impact

Conduct deep-dive, end-to-end cybersecurity investigations across cloud, identity, and hybrid systems
Investigate, contain, and resolve complex security events
Investigate advanced threats including malware, ransomware, credential theft, business email compromise, insider threats, and potential data exposure
Examine evidence across multiple platforms
Determine root cause and initial access vectors
Assess business, compliance, regulatory, and confidentiality risks
Piece together attack timelines from raw technical evidence
Deliver defensible root-cause determinations and actionable recommendations to leadership
Produce clear, executive-ready investigation reports
Brief technical and non-technical stakeholders during high-severity events
Collaborate with cross-functional technical teams, executive leaders, and regulatory stakeholders across Canada
Use modern threat detection and forensic technologies to support operational resilience and protect digital assets

Requirements

What you’ll need

Must hold, or be strictly eligible to obtain and maintain, a Government of Canada Security Clearance (Level 2 - Secret / Protected B)
Must be legally authorized to work in Canada
Proven track record and hands-on experience in cybersecurity incident response, digital forensics, or complex security investigations
Experience conducting end-to-end investigations rather than basic alert triage
Strong expertise with Microsoft Entra ID (Azure AD), Active Directory, and hybrid cloud security
Experience analyzing SIEM telemetry, forensic artifacts, network data, and operating system internals across Windows and Linux
Ability to establish defensible attack timelines, initial access vectors, and root-cause determinations
Experience assessing business risk, regulatory implications, and confidentiality impact
Ability to produce executive-ready investigation reports and brief non-technical stakeholders during high-severity events
Ability to work autonomously in a remote, distributed team across Canadian time zones
Fluency in French
Knowledge of English required for regular work with Kyndryl stakeholders
Relevant industry certifications such as GIAC GCFE, GCFA, GCIH, GNFA, or CISSP (preferred)
Hands-on experience with Velociraptor, FTK, EnCase, Volatility, KAPE, and modern EDR/XDR platforms (preferred)
Understanding of threat intelligence and MITRE ATT&CK (preferred)

Benefits

Comp & perks

Flexible, supportive remote work environment
Well-being support through Be Well programs for financial, mental, physical, and social health
Personalized development goals and continuous feedback
Certifications with Microsoft, Google, and Amazon
Coaching and hands-on learning experiences
Cutting-edge learning opportunities
Career-path tools and professional development support
Performance-based incentives and discretionary bonuses may be included
Other perks and rewards may be included in the total compensation package