AI-focused Incident Response - Cyber Security
ContractorLine of Business: Technology and OperationsBill
Start date: ASAP
Contract duration: 6 months
Extension likelihood: yes
Possibility of conversion to FTE: possible
Working hours: 830am-5pm ET,
Location: Toronto ON
Role Mandate:
The contractor will support the Incident Response organization’s AI initiatives through the development, evaluation, and operationalization of AI-assisted and agentic cybersecurity workflows. This includes building and testing workflows that use large language models, agent orchestration, retrieval-augmented generation, tool calling, structured outputs, and human-in-the-loop review to improve investigation efficiency, automate repeatable analyst activities, and enhance security operations. The role requires a strong cybersecurity background, preferably in Incident Response, threat detection, investigations, or security operations, combined with practical hands-on experience or strong working knowledge of AI workflow development, agent frameworks, automation, and emerging AI technologies. Team Structure:Standalone role on a current team of 5, with independent work but a high collaborative component across the IR team.
Role Responsibilities:
Design, prototype, and evaluate agentic AI workflows that support Incident Response use cases such as alert triage, investigation planning, evidence summarization, enrichment orchestration, disposition recommendation, and reviewer routing. Build AI-enabled workflow prototypes using frameworks and patterns such as LangGraph, LangChain, Semantic Kernel, AutoGen, CrewAI, OpenAI Assistants/Agents SDKs, GitHub Copilot SDK, or similar agent development frameworks.Develop structured agent workflows involving tool calling, retrieval-augmented generation, multi-step reasoning, state management, memory handling, guardrails, human approval checkpoints, and deterministic workflow routing. Create and maintain evaluation approaches for AI-assisted security workflows, including prompt/version testing, historical backtesting, golden datasets, adjudication comparison, hallucination/error analysis, confidence calibration, precision/recall measurement, and regression testing. Support the design of AI workflow observability and auditability, including logging of inputs, outputs, prompts, model selections, token usage, cost attribution, tool calls, intermediate reasoning artifacts where appropriate, reviewer decisions, and final dispositions. Help translate AI security workflow prototypes into operationally defensible capabilities by documenting system behavior, workflow assumptions, known failure modes, guardrails, escalation criteria, fallback procedures, and human-in-the-loop controls. Work with technology partners to assess integration patterns between AI workflows and security platforms such as SIEM, SOAR, EDR, case management, threat intelligence, enrichment APIs, ticketing systems, and internal knowledge repositories.
Must Have Skills: Strong cybersecurity background, ideally 7+ years in Incident Response, threat detection, investigations, digital forensics, security operations, threat intelligence, or adjacent cyber operations roles. Practical experience with security operations workflows, including alert triage, event enrichment, escalation decisioning, evidence collection, investigation documentation, case management, and incident response reporting. Hands-on experience designing, building, testing, or evaluating AI-assisted workflows, agentic workflows, LLM-based applications, automation pipelines, or analyst productivity tooling. Practical familiarity with agentic AI concepts such as tool calling, workflow orchestration, multi-step task execution, stateful agents, retrieval-augmented generation, prompt engineering, structured outputs, human-in-the-loop review, and guardrail design. Experience with one or more AI/agent development frameworks or SDKs such as LangGraph, LangChain, Semantic Kernel, AutoGen, CrewAI, OpenAI Assistants/Agents SDKs, GitHub Copilot SDK, Azure AI Foundry, or comparable technologies. Ability to develop or contribute to scripts, workflow components, prompt templates, structured schemas, evaluation harnesses, or lightweight applications using languages or tools such as Python, PowerShell, SQL, JSON/YAML, REST APIs, notebooks, or Git-based development workflows. Experience working with structured security data such as logs, alerts, detection outputs, case records, enrichment results, investigation notes, evidence artifacts, and historical analyst decisions to support AI-assisted analysis and backtesting. Familiarity with security operations tooling such as SIEM, EDR, SOAR, case management, threat intelligence platforms, enrichment APIs, data lakes, or internal security knowledge repositories. Understanding of AI workflow evaluation concepts, including ground-truth comparison, false positive/false negative review, confidence scoring, agreement rate, miss-rate analysis, prompt/version comparison, regression testing, and workflow reliability measurement. Strong analytical and problem-solving skills, with the ability to challenge AI-generated outputs, identify unsupported conclusions, validate findings against source evidence, and balance speed with investigative rigor. Strong written communication skills, including the ability to produce clear workflow documentation, technical notes, structured analysis, evaluation findings, governance documentation, and defensible summaries for operational and leadership audiences. Ability to collaborate with Incident Response leadership, analysts, domain SMEs, technology partners, and governance stakeholders to convert operational needs into practical, controlled, and measurable AI-enabled workflows.
Nice to Have Skills:
Professional security certification such as CISSP, GCIH, GCFA, GCFE, GCFR, or equivalent Relevant postsecondary
Pay: $90.00-$100.00 per hour
Work Location: Hybrid remote in Toronto, ON (Toronto District)
