Tekstraton is seeking an experienced and analytical Senior Incident Response & Threat Hunter to join our cyber defense practice in Toronto, ON on a hybrid basis. In this pivotal role, you will serve as a frontline defender across enterprise and cloud environments, leading complex incident triage, performing deep-dive forensic investigations, and orchestrating proactive threat-hunting campaigns to unmask advanced persistent threats (APTs) before impact occurs.
Key Responsibilities:
- Lead end-to-end incident response engagements, driving rapid containment, eradication, and forensic root-cause analysis for high-severity security incidents.
- Develop and execute hypothesis-driven threat hunting operations leveraging EDR telemetry, SIEM data, and the MITRE ATT&CK framework.
- Conduct deep-dive forensic analysis of host artifacts, memory dumps, disk images, and network traffic across Windows, Linux, and cloud assets.
- Perform static and dynamic triage of malicious payloads, scripts, and living-off-the-land techniques to extract actionable indicators of compromise (IoCs).
- Translate novel adversary tradecraft into high-fidelity detection rules (Sigma, YARA, Splunk SPL, KQL) in partnership with SOC engineering.
- Draft comprehensive post-incident technical reports and executive debriefs with remediation roadmaps for leadership.
Requirements:
- 5+ years of dedicated professional experience in Digital Forensics, Incident Response (DFIR), or dedicated Threat Hunting.
- Deep practical experience with enterprise EDR suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) and modern SIEM architectures.
- Strong background in network protocol analysis, OS internals (Windows/Linux), and forensic artifact extraction.
- Hands-on scripting proficiency in Python, PowerShell, or Bash for hunting automation and log aggregation.
- Relevant industry certifications (e.g., GIAC GCIH, GCFA, GNFA, OSCP, or equivalent).
- Located in the Greater Toronto Area and eligible to work in Canada, with availability for hybrid work (2 days per week in-office).