Incident Response Specialist

BMO•Toronto, ON

1d•CA$67,200 - CA$124,200•Hybrid

About The Position

Join BMO’s Threat Response Operations Team as an Incident Response Specialist, responsible for protecting BMO against evolving cyber threats. You will investigate and respond to complex Level 2 cybersecurity incidents, working alongside experienced professionals across Threat Intelligence, Detection, Incident Management, and GSOC teams. This role involves investigating escalated cyber incidents, producing high-quality incident documentation, collaborating across security teams, and contributing to operational readiness and continuous improvement efforts. It's an excellent opportunity for cybersecurity professionals to deepen their expertise in incident response and enterprise threat operations within a collaborative and high-impact environment. This position offers the chance to be part of a mature and advanced cyber incident response program within a leading financial institution, work on real-world investigations involving threat containment, mitigation, and forensic analysis, and gain exposure to enterprise-scale cybersecurity operations and advanced EDR tooling. You will also contribute to continuous improvement initiatives that strengthen BMO’s security capabilities. The role operates on a hybrid model with office flexibility across Toronto, Scarborough, or Barrie. Shifts are compressed, 4 days per week with 10-hour shifts, including weekends and statutory holidays unless vacation is booked. Shift assignments are either Sunday–Wednesday or Wednesday–Saturday, based on business needs.

Requirements

Security Operations / Incident Response experience —3–4 years.
Breach-class incident response investigation —3–4 years.
Digital forensics / forensic analysis —2–3 years.
Incident response using EDR tooling (endpoint detection monitoring tools)—3–4 years.
Developing and assessing operational process documentation —3–4 years
Live response analysis and development of host activity timelines —3–4 years.
Incident response reporting —2–3 years.
Typically between 2 - 4 years of relevant experience and post-secondary degree in Business or Computer Science, or a related field of study or an equivalent combination of formal training, or industry / technical certifications or work experience.
Experience in Information Security or with multiple areas of systems and computer operations (e.g. Identity & Access Management, IT operations, Certification & Key Management, Security Platform Administration, Security Incident Response).
Understanding and problem solving ability of information security issues within their business group - In-depth.
Partnering, communication, and negotiation skills to communicate effectively within the team and with technology and business partners - Working.
Understands the scope of complexity that exists in the operating environment and the ways which security platforms impact that environment.
Knowledge of Information Security support and operations concepts, practices, concepts, and technology obtained through formal training and work experience.
Knowledge of Information Security processes, procedures and controls - In-depth.
Knowledge of the technical and business environment and the corporate processes and procedures - In-depth.
Technical proficiency gained through education and/or business experience.
Verbal & written communication skills - In-depth.
Collaboration & team skills - In-depth.
Analytical and problem solving skills - In-depth.
Influence skills - In-depth.
Data driven decision making - In-depth.

Nice To Haves

Preference for candidates who have or are pursuing at least one certification in a related field, with strong preference for Information Security certifications from a well-recognized institution (e.g. (ISC)2, ISACA, SANS).

Responsibilities

Monitors, restores service, changes, supports and handles day-to-day activities 7/24/365 required to run the mission critical Information Security systems for BMO.
Provides responsive customer service in support of cyber security.
Monitors & maintains security tools and applications.
Collaborates with internal and external stakeholders in order to deliver on business objectives and to support operational activities for Information Security.
Identifies opportunities to strengthen the capability of the Information Security organization at BMO, such as: sharing expertise to promote technical development and mentoring employees.
Recommends approaches or changes to streamline and integrates security processes and systems in the organization, while considering Information Security methodology to improve overall efficiency.
Builds effective relationships with internal/external stakeholders.
Anticipates and reduces complexity for others.
Provides input into the planning and implementation of operational programs.
Develops and documents procedures and processes, conforming to the industry best practices and Bank’s security regulations, policies and standards.
Assists in the preparation of end user materials.
Gathers and documents requirements for use in various audits, reports, & projects.
Creates activity reports for security tools and applications.
Develops an understanding of organizational interactions and complexity to engage with the appropriate matrix areas.
Actions service requests, transactions, queries etc. within relevant service level agreements.
Coordinates and facilitates incident management activities.
Includes deploying changes to the production environment and engaging 2nd party providers contracted to the Bank during an incident.
Provides technical Information Security subject matter expertise.
Stays abreast of industry technical and business trends through participation in professional associations, practice communities and individual learning.
Ensures consistent, high quality practices/work and the achievement of business results in alignment with business/group strategies and with productivity goals.
Exercises judgment to identify, diagnose, and solve problems within given rules.
Works independently on a range of complex tasks, which may include unique situations.
Broader work or accountabilities may be assigned as needed.
Take measured risks while protecting the bank by applying our Risk Management Framework in the execution of your role, in line with our Risk Culture and within our approved Risk Appetite, making sound and risk informed decisions that align to business strategy, protect assets, and adhere to applicable policy documents (Frameworks, Policies, Standards, Procedures and Supporting documents), laws and regulations.