Security Incident Management, Forensic Lead

Who We Are:

Every transaction matters. Every Canadian matters. At Interac, we protect both — driving trust, security, and inclusion, so our digital economy thrives. Founded in 1984, Interac connects Canadians through secure digital payments, advanced identity verification and industry‑leading fraud protection. Connecting banks, businesses, and individuals, Interac enables millions to send, receive, and manage money safely and effortlessly every day — across both digital and physical environments.

As the backbone of Canada’s financial ecosystem, Interac facilitates over 20 million transactions daily, supported by trusted partnerships with government and financial institutions. Consistently ranked as Canada’s most reputable financial technology brand, Interac is deeply embedded in the daily lives of Canadians.

The vacant Security Incident Management, Forensic Lead role will report to the Leader, Security Incident Management. The Security Incident Management, Forensic Lead will be responsible to provide expert‑level subject matter expert in digital forensics across host, cloud, network, and mobile environments. You will play a critical role within the Cybersecurity Incident Management & Response (IMR) team, leading complex investigations, performing advanced security content analysis, and supporting the organization’s overall cybersecurity posture.

This role requires a highly skilled technical professional capable of managing evidence, applying best‑practice forensic methodologies, and providing actionable insights to contain, remediate, and prevent security incidents.

• Content Analysis/Digital Forensics

  • File analysis - static and dynamic analysis of files including disassembly, decompilation, taint analysis, and sandbox analysis

  • Network traffic and packet (PCAP) analysis - the analysis of network traffic and payloads for C2, data exfiltration, reconnaissance/discovery and lateral movement

  • User behaviour analysis (UBA) - analysis of user behaviour to determine baselines and identify anomalies

  • Data analysis - using large data techniques (e.g. data mining) to detect malicious behaviour

• Supporting threat hunting activities and correlating content analysis/forensic findings with broader security events.

• Coordinating with forensics vendor(s) during incidents to conduct digital forensics.

• Documenting and communicating investigative findings in clear, actionable reports for both technical teams and executive stakeholders.

• Providing analysis and support for eDiscovery and legal investigations, ensuring regulatory and compliance requirements are met.

• Sundry Security Incident Management related duties as assigned.

• Developing and maintaining the content analysis readiness program, including procedures, tooling, and best practices.

• Developing proper evidence handling and chain of custody procedures for Tier 1 Analysts during investigations.

• Managing and maintaining content analysis tools and solutions (e.g., file/malware analysis tools, network forensics and packet capture analysis tools, etc), including tool selection, deployment, tuning, and lifecycle management.

• Mentoring and providing forensic guidance to Security Incident Analysts within the team.

• Staying current with emerging forensic techniques, tools, and threat actor methodologies, applying this knowledge to improve organizational response capabilities.

• Fine‑tune detection rules and enhance security monitoring.

• Developing complex detection use cases based on content analysis findings.

• Provide content analysis support to the Cyber Threat Intelligence team to support IOC and TTP development, and enrich reporting

• Eligibility to work for Interac Corp. in Canada in a full‑time capacity.

• Minimum 5–7 years of experience in digital forensics (e.g. O/S analysis, file analysis, network traffic analysis, packet capture analysis, UBA), incident response, or cybersecurity investigations.

• Hands‑on experience with host, cloud, network, and mobile content analysis forensics.

• Deep understanding of cybersecurity incident lifecycle, threat actor tactics, and…