{"id":1689278,"url":"https://alion.io/job/kpmg-manager-cyber-defence","title":"Manager, cyber defence","company":{"id":1186989,"name":"KPMG Canada","domain":"kpmg.ca","url":"https://alion.io/company/kpmg-ca","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Toronto, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":67000,"max_usd":122000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":40},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Autopsy","optional":false},{"name":"Bash","optional":false},{"name":"C#","optional":false},{"name":"Carbon Black","optional":false},{"name":"Crowdstrike","optional":false},{"name":"EnCase","optional":false},{"name":"FTK","optional":false},{"name":"Kibana","optional":false},{"name":"Linux","optional":false},{"name":"Magnet AXIOM","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SentinelOne","optional":false},{"name":"Splunk","optional":false},{"name":"Sumo Logic","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-09-23T00:00:00Z","employer_posted_date":null,"last_verified_at":"2026-09-23T00:00:00Z","board_verified":false,"closed_at":null,"days_open":27,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":27},"description":"Overview\n\nAt KPMG in Canada, our people bring their unique perspectives to Canada’s most important challenges. Here, you can build momentum that reaches beyond our business, develop skills for the future, and take ownership of your career with support at every stage. Join a firm where your career can make a difference.\n\nAre you a talented individual with a proven track record on executing project deliverables. \n\nOur Toronto team is looking for a highly motivated Cyber Security professional at a Manager level to join our team! As a member of KPMG Canada’s cross-functional Cyber team, you will be dedicated to the defense and protection of our client critical data, systems, and assets through cyber defense and incident response services.\n\nA career within our Cyber Security practice will provide you with the opportunity to help our clients implement robust cybersecurity programs that protects against threats, propels digital and business transformation, and drives growth. As companies pivot toward a digital business model, exponentially more data is generated and shared among organizations, partners and customers. We play an integral role in helping our clients ensure they are protected by developing transformation strategies focused on security, efficiently integrate and manage new or existing technology systems to deliver continuous operational improvements and increase their cybersecurity investment, and detect, respond, and remediate threats.\n\nKPMG’s Cyber team has received tremendous investment and has been identified as a transformational part of the firm to deliver growth over the next five years. This is an excellent opportunity for those that are looking to stay ahead of the curve and work in a firm with unparalleled career progression opportunities. \n\nWhat you will do\n\nAs a Manager you’ll work as part of a team of problem solvers with extensive consulting and industry experience, supporting our technical engagement team and leveraging your expertise on Incident Response projects and tasks. Specific responsibilities include but are not limited to:\nEngage with a variety of clients on incident response engagements ranging and tasks from operating system security, cloud and network security, cryptography, software security, malware analysis, digital forensics for incident response activities, security operations, and emergent security intelligence;\n\nPerform incident response and cyber investigations. These engagements will require urgent organization, configuring needed toolsets, and communication with the client;\nLeverage forensic tools to on incident response collect, process and analyze computer based evidence (host and network based). Use end-point detection and response (EDR) tools to investigate, monitor and triage potentially compromised end-points;\nPerform digital forensic evidence collection throughout the incident response phases, extensive log analysis and meta-data analysis;\nPerform operating system and hard drive digital forensic evidence analysis;\nAnalyze results from tools and determine: indicators of compromise (IOCs), root cause of compromise, possible attack vectors, potential threat actors and the overall risk/threat the client is facing;\nProvide recommendations and advise on steps to mitigate the current attack, present risks and remediate the potentially vulnerable environment and remove the ability of ongoing/future attacks;\nAnalyze results of assessment and create technical accurate and articulate reports in a business professional language, to be shared with technical stakeholder, executive stakeholders and potentially third parties;\nLeverage out-of-the-box thinking to tackle and overcome complex client challenges;\nRemain current on the threat landscape, including common and recent threats. Keep your team and clients informed on relevant threat and attack vectors on an on-going basis;\nContribute to the KPMG Incident Response team’s practice development by actively supporting a Cyber/Forensics lab, writing whitepapers, conducting and sharing research, actively assisting with business development opportunities.\n\nWhat you bring to the role\n\nUndergraduate degree in Computer Science, Information Technology, or related field;\nCompletion of at least one relevant certification such as GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Examiner (GCFE), EnCase Certified Examiner (EnCE), CCFP ISC(2) or similar;\n5+ years of experience with incident response, preferably in a consulting environment. Internal CSIRT experience will also be considered;\n5+ years of experience with forensic data collection with technical network, hard drive, and operating systems. Candidates should also have experience with collecting data from cloud platforms for investigations that involve SaaS and PaaS;\nExperience working on consulting incident response engagements with clients, including post-incident reviews;\nCyber investigation and threat hunting experience;\nAbility to identify and create IOCs (Indicators of Compromise) from performing forensic analysis activities, articulate IOC in technical formats, and present them to stakeholders;\nHands-on experience and working knowledge of at least one common industry leading or open-source forensic software application (e.g. EnCase, FTK, Autopsy, Magnet Axiom, Cellebrite, Magnet IEF/Axiom) and techniques to capture and process electronic data from computers, virtual machines, external media, networks and mobile data devices;\nHands on experience with the installation and configuration of End-Point Detection and Response tools, such as Carbon Black, Sentinel One, CrowdStrike Falcon or Elastic Stack;\nStrong knowledge of common attack vectors, initial compromise, lateral movement, privilege escalation and data exfiltration techniques;\nKnowledge of operating systems, networking, web protocol, and cloud architecture;\nAbility to perform log, host and network-based traffic monitoring and analysis, across varying devices, platforms and formats;\nAbility to perform hard drive digital forensics within the incident response phases, across various file and device formats, including Windows and Linux operating systems and mobile device.\nAbility to fulfill regular on-call responsibilities, as part of a team, for urgent incident response activities.\nMaster's Degree within a specialization in Cyber Security, Digital Forensics or a related field is advantageous;\nCompletion of any additional Cyber Security certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Ethical Hacker (CEH), Offensive Security Certified Professional (OSCP) or similar would be advantageous.;\nHands-on experience incident response and log analytics tools, such as Elastic, Log Stash and Kibana, Sumo Logic, Splunk, etc. Familiarity with multiple open-source tools for data and log analysis;\nReverse engineering experience on various types of malware, including ransomware, malicious droppers, trojans, customized and obfuscated malicious scripts and other types of malicious files will be advantageous;\nExperience with forensic evidence handling and chain-of-custody procedures and knowledge of potential litigation requirements;\nExperience with programming languages (C, C#) and scripting languages (e.g. Python and Go) and familiar with Bash and PowerShell;\nExperience in other technical Cyber Security domains, such as Penetration Testing, Red Teaming, Security Operation Centre (SOC) or Blue Teaming;\nAble to create solutions and modify your tools, plugins and scripts appropriately to problem at hand; \nKnowledge of common threat actor TTPs (tools, techniques and procedures and how they relate to the stages of the MITRE ATT&CK® Framework.\nKPMG Ontario Region Pay Range Information\nThe expected base salary range for this position is $110,000 to $160,000 and may be eligible for bonus awards. The determination of an applicant’s base salary within this range is based on the individual’s location, skills & competencies, and unique qualifications. In addition, KPMG offers a comprehensive and competitive Total Rewards program.\n\nProviding you with the support you need to be at your best\n\nOur Values, The KPMG Way\n\nIntegrity, we do what is right | Excellence, we never stop learning and improving | Courage, we think and act boldly | Together, we respect each other and draw strength from our differences | For Better, we do what matters\n\nKPMG in Canada is a proud equal opportunities employer and we are committed to creating a respectful, inclusive and barrier-free workplace that allows all of our people to reach their full potential. A diverse workforce is key to our success and we believe in bringing your whole self to work. We welcome all qualified candidates to apply and hope you will choose KPMG in Canada as your employer of choice.\n\nAdjustments and accommodations throughout the recruitment process\n\nAt KPMG, we are committed to fostering an inclusive recruitment process where all candidates can be themselves and excel. We aim to provide a positive experience and are prepared to offer adjustments or accommodations to help you perform at your best. Adjustments (informal requests), such as extra preparation time or the option for micro breaks during interviews, and accommodations (formal requests), such as accessible communication supports or technology aids, are tailored to individual needs and role requirements. You will have an opportunity to request an adjustment or accommodation at any point throughout the recruitment process. If you require support, please contact KPMG’s Employee Relations Service team by calling 1-888-466-4778.\n\nAI Usage\n\nWe embrace the use of artificial intelligence (AI) to enhance the candidate experience and streamline our recruitment processes. AI tools may help with organizing applications or surfacing relevant qualifications. However, no hiring decisions are made using AI. Every hiring decision is made by our hiring managers and recruitment professionals, who are equipped with training that empowers them to use these tools responsibly. AI technologies used in our recruitment process undergo detailed risk assessments, including security and privacy requirements, that align with KPMG’s Trusted AI framework.\n\nWe believe technology should empower human judgment, not replace it. It’s one of the many ways we’re delivering on our vision of being a technology-first, people-driven firm.","description_format":"text","description_chars":10466,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Incident Response","Financial Advisory, Valuation & Restructuring","Management Consulting"],"lifecycle":[{"event":"open","at":"2026-10-02T10:40:56Z"}],"visa":[{"country":"CA","licensed_sponsor":true,"evidence":"Positions approved through LMIA in 12 months: 13","filings_12m":13,"filings_prev_12m":22,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"High Wage; Global Talent Stream","cap_exempt":false,"checked_at":"2026-10-03T21:10:52+00:00","sources":["ESDC: employers issued a positive LMIA"],"filings_for_role_12m":1}],"liveness":{"score":48,"band":"ok","label":"Likely open","p_open":0.85,"p_active":0.749,"p_room":0.75,"age_days":26,"expected_fill_days":30,"reasons":["seen:26","velocity","win:late"],"computed_at":"2026-10-19T05:45:15Z"},"pay":null,"html_url":"https://alion.io/job/kpmg-manager-cyber-defence","json_url":"https://alion.io/job/kpmg-manager-cyber-defence.json","meta":{"generated_at":"2026-10-20T05:19:54Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5871,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-21T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1186989},"rest":"https://alion.io/mcp/rest/get_company?id=1186989"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkpmg-manager-cyber-defence"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkpmg-manager-cyber-defence"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkpmg-manager-cyber-defence"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kpmg-manager-cyber-defence\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkpmg-manager-cyber-defence"}]}