Incident Response Specialist

BMO is currently sourcing for an Incident Response Specialist. This is a hybrid contract role in Toronto (2 days in office per week).
Role Overview:
The Incident Response Specialist will support BMO’s Threat Response Operations team by investigating and responding to complex Level 2 cybersecurity incidents. The role involves conducting breach-class incident investigations, forensic analysis, and collaborating with various security teams to enhance operational readiness. This position plays a critical role in protecting BMO against evolving cyber threats and strengthening the bank’s security posture.
Key Responsibilities:

Monitor, restore service, and support day-to-day activities for mission-critical Information Security systems 24/7/365.
Investigate and respond to escalated cyber incidents, including threat containment and mitigation.
Maintain and monitor security tools and applications to ensure operational effectiveness.
Collaborate with internal and external stakeholders to support Information Security objectives and operational activities.
Develop and document incident response processes, procedures, and reports in alignment with industry best practices.
Coordinate incident management activities, including deploying changes and engaging third-party providers during incidents.
Identify opportunities to improve Information Security capabilities and contribute to continuous improvement initiatives.

Must-Have Skills:

3–4 years of Security Operations and Incident Response experience.
3–4 years of breach-class incident response investigation experience.
2–3 years of digital forensics and forensic analysis experience.
3–4 years of experience using Endpoint Detection and Response (EDR) tools for incident response.
Experience developing and assessing operational process documentation.
Experience with live response analysis and host activity timeline development.
Incident response reporting experience.
Post-secondary degree in Business, Computer Science, or related field, or equivalent training/certifications.
Knowledge of Information Security processes, procedures, controls, and technical environment.

Nice to Have Skills:

Certifications from recognized institutions such as (ISC)², ISACA, or SANS.
Experience with multiple areas of systems and computer operations including Identity & Access Management, IT operations, and Security Platform Administration.
Familiarity with enterprise-scale cybersecurity operations and advanced EDR tooling.

Ideal Candidate:

Experience working within a mature and advanced cyber incident response program in a financial institution.
Ability to work compressed 4-day, 10-hour shifts including weekends and statutory holidays.
Proven ability to contribute to continuous improvement initiatives and operational readiness.
Experience collaborating across security teams such as Threat Intelligence, Detection, Incident Management, and GSOC.