Sr. Consultant - Enterprise Incident Management | Remote, Canada

This position will be fully remote and can be hired in any Canadian province except for Quebec.

An Enterprise Incident Management (EIM) Consultant is a highly skilled incident responder capable of performing complex investigations while maintaining a business focus and meeting client requirements. This position will work both independently and as part of a team to perform digital investigations including: Zero Day Exploitation, Business Email Compromise, Unauthorized Access, Sensitive Data Exposure, Insider Threat, Malware Analysis, and Threat Hunting. An EIM Consultant also contributes to the development and continuous improvement of the EIM practice through various team and industry contributions.

How you'll make an impact

• Lead and independently deliver complex Incident Response (IR), Digital Forensics (DFIR), Threat Hunting, Compromise Assessment, and Incident Readiness engagements.
• Serve as the primary technical lead and client-facing advisor during cybersecurity incidents, including ransomware, business email compromise, cloud compromise, insider threat, and unauthorized access investigations.
• Act as a technical escalation point to assist consultants with complex investigations, forensic analysis, and threat-hunting activities.
• Lead evidence collection, preservation, forensic analysis, threat scoping, root cause analysis, and remediation planning efforts.
• Conduct and facilitate proactive security engagements including Incident Response Plan development, Playbook development, Incident Response Readiness Assessments, Tabletop Exercises, and maturity reviews.
• Lead threat hunting and compromise assessment activities utilizing endpoint, network, cloud, identity, and security telemetry to identify malicious activity and emerging threats.
• Develop and present technical findings, executive briefings, remediation recommendations, and final engagement reports to client stakeholders.
• Lead engagement planning, project execution, and client communications to ensure successful delivery and high levels of customer satisfaction.
• Perform peer review and quality assurance of reports, deliverables, and investigative findings produced by other team members.
• Mentor Associate Consultants and Consultants through technical coaching, knowledge transfer, and professional development activities.
• Contribute to the development and improvement of service offerings, methodologies, automation, detection content, and operational processes within the EIM practice.
• Maintain professional and technical knowledge through research, industry participation, professional associations, training, and continuous education.
• Obtain and maintain industry-recognized certifications relevant to Incident Response, Digital Forensics, Threat Hunting, and Information Security.
• Complete administrative project tasks including time entry, expense reporting, status reporting, utilization tracking, and project completion activities.
• Actively contribute to Optiv communities, knowledge-sharing initiatives, thought leadership, and innovation efforts aligned to Enterprise Incident Management services.

What we're looking for

• Bachelor's degree and approximately 5-8 years of related cybersecurity, digital forensics, incident response, threat hunting, or consulting experience.
• Minimum 5 years of hands-on experience performing incident response activities including containment, eradication, recovery, digital forensics, root cause analysis, and remediation.
• Demonstrated experience leading cybersecurity investigations and client-facing consulting engagements.
• Experience developing and conducting proactive services including Incident Response Plans, Playbooks, Tabletop Exercises, Readiness Assessments, and Security Program Maturity Assessments.
• Strong understanding of networking concepts including TCP/IP, DNS, DHCP, routing, firewalls, VPNs, IDS/IPS technologies, and cloud networking.
• Strong understanding of Windows, Linux, macOS, virtualization platforms, cloud environments, Active Directory, Entra ID, and enterprise identity technologies.
• Experience utilizing Digital Forensics, EDR, SIEM, and investigative platforms including technologies such as Velociraptor, CrowdStrike, Microsoft Defender, SentinelOne, Carbon Black, Splunk, Microsoft Sentinel, X-Ways, FTK, EnCase, Volatility, Tools, KAPE, and related solutions.
• Knowledge of common adversary tactics, techniques, and procedures (TTPs) and familiarity with frameworks such as MITRE ATT&CK and NIST Incident Response guidance.
• Understanding of regulatory, privacy, and compliance requirements including PCI DSS, GLBA, HIPAA, NIST, State Data Privacy Laws, and other industry-specific frameworks.
• Strong written, presentation, and communication skills with the ability to effectively communicate complex technical findings to technical and executive audiences.
• Ability to build trusted advisor relationships with clients and collaborate effectively across multiple teams and disciplines.
• Ability to manage multiple projects, priorities, and client engagements simultaneously in a fast-paced environment.
• Ability to exercise sound judgment and make effective decisions during high-pressure incident response situations.
• Ability to travel 25-40% of the time to client sites.
• This position requires the ability to respond onsite in a 24/7/365 environment; must be willing to work evening, overnight, and weekend/holiday hours.
• Preferred certifications include: GIAC Certified Forensics Examiner (GCFE), GIAC Certified Incident Handler (GCIH), EC-Council Certified Incident Handler (ECIH), and Certified Computer Forensics Examiner (CCFE).
• #LI-GN1

• A company committed to championing Diversity, Equality, and Inclusion through our Employee Resource Groups .
• Work/life balance
• Professional training resources
• Creative problem-solving and the ability to tackle unique, complex projects
• Volunteer Opportunities. "Optiv Chips In" encourages employees to volunteer and engage with their teams and communities.
• The ability and technology necessary to productively work remotely/from home (where applicable)