Sr. Consultant - Enterprise Incident Management | Remote, Canada

Optiv

2d•Remote

About The Position

The Enterprise Incident Management (EIM) Consultant is a highly skilled incident responder who performs complex investigations while maintaining a business focus and meeting client requirements. The role works independently and as part of a team on digital investigations involving zero-day exploitation, business email compromise, unauthorized access, sensitive data exposure, insider threat, malware analysis, and threat hunting. The consultant also contributes to developing and continuously improving the EIM practice through team and industry contributions. This position is fully remote and may be hired in any Canadian province except Quebec. It requires the ability to respond onsite in a 24/7/365 environment, willingness to work evening, overnight, and weekend or holiday hours, and the ability to travel 25–40% of the time to client sites.

Requirements

Bachelor's degree and approximately 5–8 years of related cybersecurity, digital forensics, incident response, threat hunting, or consulting experience.
At least 5 years of hands-on incident response experience, including containment, eradication, recovery, digital forensics, root cause analysis, and remediation.
Demonstrated experience leading cybersecurity investigations and client-facing consulting engagements.
Experience developing and conducting proactive services such as incident response plans, playbooks, tabletop exercises, readiness assessments, and security program maturity assessments.
Strong understanding of networking concepts, including TCP/IP, DNS, DHCP, routing, firewalls, VPNs, IDS/IPS technologies, and cloud networking.
Strong understanding of Windows, Linux, macOS, virtualization platforms, cloud environments, Active Directory, Entra ID, and enterprise identity technologies.
Experience with digital forensics, EDR, SIEM, and investigative platforms, including technologies such as Velociraptor, CrowdStrike, Microsoft Defender, SentinelOne, Carbon Black, Splunk, Microsoft Sentinel, X-Ways, FTK, EnCase, Volatility, Tools, and KAPE.
Knowledge of common adversary tactics, techniques, and procedures (TTPs), and familiarity with frameworks such as MITRE ATT&CK and NIST Incident Response guidance.
Understanding of regulatory, privacy, and compliance requirements, including PCI DSS, GLBA, HIPAA, NIST, State Data Privacy Laws, and other industry-specific frameworks.
Strong written, presentation, and communication skills, including the ability to explain complex technical findings to technical and executive audiences.
Ability to build trusted-advisor relationships with clients and collaborate across multiple teams and disciplines.
Ability to manage multiple projects, priorities, and client engagements simultaneously in a fast-paced environment.
Ability to exercise sound judgment and make effective decisions during high-pressure incident response situations.
Ability to travel 25–40% of the time to client sites.
Ability to respond onsite in a 24/7/365 environment and willingness to work evening, overnight, and weekend or holiday hours.

Nice To Haves

GIAC Certified Forensics Examiner (GCFE) certification.
GIAC Certified Incident Handler (GCIH) certification.
EC-Council Certified Incident Handler (ECIH) certification.
Certified Computer Forensics Examiner (CCFE) certification.

Responsibilities

Lead and independently deliver complex incident response, digital forensics, threat hunting, compromise assessment, and incident readiness engagements.
Serve as the primary technical lead and client-facing advisor during cybersecurity incidents, including ransomware, business email compromise, cloud compromise, insider threat, and unauthorized access investigations.
Act as a technical escalation point for consultants handling complex investigations, forensic analysis, and threat-hunting activities.
Lead evidence collection and preservation, forensic analysis, threat scoping, root cause analysis, and remediation planning.
Conduct proactive security engagements, including incident response plan and playbook development, incident response readiness assessments, tabletop exercises, and maturity reviews.
Lead threat hunting and compromise assessments using endpoint, network, cloud, identity, and security telemetry.
Develop and present technical findings, executive briefings, remediation recommendations, and final engagement reports to client stakeholders.
Lead engagement planning, project execution, and client communications to support successful delivery and customer satisfaction.
Perform peer review and quality assurance of reports, deliverables, and investigative findings produced by other team members.
Mentor Associate Consultants and Consultants through technical coaching, knowledge transfer, and professional development.
Contribute to service offerings, methodologies, automation, detection content, and operational process improvements within the EIM practice.
Maintain professional and technical knowledge through research, industry participation, professional associations, training, and continuous education.
Obtain and maintain industry-recognized certifications relevant to incident response, digital forensics, threat hunting, and information security.
Complete administrative project tasks, including time entry, expense reporting, status reporting, utilization tracking, and project completion activities.
Contribute to Optiv communities, knowledge-sharing initiatives, thought leadership, and innovation efforts aligned with Enterprise Incident Management services.