OVERVIEW
The AI-focused Incident Response Contractor will play a pivotal role in supporting the Incident Response organization’s AI initiatives. This position involves the development, evaluation, and operationalization of AI-assisted cybersecurity workflows, utilizing advanced technologies to enhance investigation efficiency and automate analyst activities. The contractor will work on building and testing workflows that leverage large language models, agent orchestration, and human-in-the-loop reviews to improve security operations.
The ideal candidate will possess a strong background in cybersecurity, particularly in Incident Response and threat detection, combined with hands-on experience in AI workflow development. They will thrive in a collaborative environment, working independently while engaging with various stakeholders to translate operational needs into effective AI-enabled solutions. Strong analytical skills and the ability to communicate complex concepts clearly will be essential for success in this role.
Location: Toronto, ON (Hybrid)
Contract Length: 6 months, with extension or FTE conversion possibility
Hours: 8:30 AM - 5:00 PM ET, with flexibility for different time zones
T4: $110-120 iC: $135-138
RESPONSIBILITIES
- Design, prototype, and evaluate agentic AI workflows that support Incident Response use cases such as alert triage, investigation planning, evidence summarization, enrichment orchestration, disposition recommendation, and reviewer routing.
- Build AI-enabled workflow prototypes using frameworks and patterns such as LangGraph, LangChain, Semantic Kernel, AutoGen, CrewAI, OpenAI Assistants/Agents SDKs, GitHub Copilot SDK, or similar agent development frameworks.
- Develop structured agent workflows involving tool calling, retrieval-augmented generation, multi-step reasoning, state management, memory handling, guardrails, human approval checkpoints, and deterministic workflow routing.
- Create and maintain evaluation approaches for AI-assisted security workflows, including prompt/version testing, historical backtesting, golden datasets, adjudication comparison, hallucination/error analysis, confidence calibration, precision/recall measurement, and regression testing.
- Support the design of AI workflow observability and auditability, including logging of inputs, outputs, prompts, model selections, token usage, cost attribution, tool calls, intermediate reasoning artifacts, reviewer decisions, and final dispositions.
- Help translate AI security workflow prototypes into operationally defensible capabilities by documenting system behavior, workflow assumptions, known failure modes, guardrails, escalation criteria, fallback procedures, and human-in-the-loop controls.
- Work with technology partners to assess integration patterns between AI workflows and security platforms such as SIEM, SOAR, EDR, case management, threat intelligence, enrichment APIs, ticketing systems, and internal knowledge repositories.
QUALIFICATIONS
- Strong cybersecurity background, ideally with 7+ years in Incident Response, threat detection, investigations, digital forensics, security operations, or adjacent cyber operations roles.
- Practical experience with security operations workflows, including alert triage, event enrichment, escalation decisioning, evidence collection, investigation documentation, case management, and incident response reporting.
- Hands-on experience designing, building, testing, or evaluating AI-assisted workflows, agentic workflows, LLM-based applications, automation pipelines, or analyst productivity tooling.
- Practical familiarity with agentic AI concepts such as tool calling, workflow orchestration, multi-step task execution, stateful agents, retrieval-augmented generation, prompt engineering, structured outputs, human-in-the-loop review, and guardrail design.
- Experience with one or more AI/agent development frameworks or SDKs such as LangGraph, LangChain, Semantic Kernel, AutoGen, CrewAI, OpenAI Assistants/Agents SDKs, GitHub Copilot SDK, Azure AI Foundry, or comparable technologies.
- Ability to develop or contribute to scripts, workflow components, prompt templates, structured schemas, evaluation harnesses, or lightweight applications using languages or tools such as Python, PowerShell, SQL, JSON/YAML, REST APIs, notebooks, or Git-based development workflows.
- Experience working with structured security data such as logs, alerts, detection outputs, case records, enrichment results, investigation notes, evidence artifacts, and historical analyst decisions to support AI-assisted analysis and backtesting.
- Familiarity with security operations tooling such as SIEM, EDR, SOAR, case management, threat intelligence platforms, enrichment APIs, data lakes, or internal security knowledge repositories.
- Understanding of AI workflow evaluation concepts, including ground-truth comparison, false positive/false negative review, confidence scoring, agreement rate, miss-rate analysis, prompt/version comparison, regression testing, and workflow reliability measurement.
- Strong analytical and problem-solving skills, with the ability to challenge AI-generated outputs, identify unsupported conclusions, validate findings against source evidence, and balance speed with investigative rigor.
- Strong written communication skills, including the ability to produce clear workflow documentation, technical notes, structured analysis, evaluation findings, governance documentation, and defensible summaries for operational and leadership audiences.
- Ability to collaborate with Incident Response leadership, analysts, domain SMEs, technology partners, and governance stakeholders to convert operational needs into practical, controlled, and measurable AI-enabled workflows.
TECHNICAL SKILLS
- Experience with AI/agent development frameworks such as LangGraph, LangChain, Semantic Kernel, AutoGen, CrewAI, OpenAI Assistants/Agents SDKs, GitHub Copilot SDK, or Azure AI Foundry.
- Proficiency in programming languages and tools such as Python, PowerShell, SQL, JSON/YAML, REST APIs, and Git-based development workflows.
- Familiarity with security operations tools including SIEM, EDR, SOAR, and threat intelligence platforms.
PREFERRED
- Professional security certification such as CISSP, GCIH, GCFA, GCFE, GCFR, or equivalent.
- Relevant postsecondary education.
We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, disability status, or other non-merit factor. We are committed to creating a diverse and inclusive environment for all employees.
