Incident Response Lead

This role can be located in any CGI office in Canada. The Incident Response Lead is part of CGI's Global Security Operations Center (GSOC), which provides 24/7 security monitoring, threat detection, and incident response capabilities across the organisation. As a senior member of GSOC, the Incident Response Lead is responsible for leading the technical response to complex cybersecurity incidents, coordinating investigations, and driving containment, eradication, and recovery activities. Acting as the technical authority during major incidents, the role provides Incident leadership in GSOC while ensuring investigations are conducted using industry best practices and forensically sound methodologies. The Incident Response Lead works closely with Security Monitoring, Detection Engineering, Threat Intelligence, Security Engineering, IT Operations, and business stakeholders to minimise organisational risk, improve incident response capabilities, and strengthen CGI's overall cyber resilience. This role requires extensive experience in cyber incident response, digital forensics, threat actor tactics, techniques and procedures (TTPs), malware analysis, enterprise infrastructure, and cloud technologies. The successful candidate will combine deep technical expertise with strong leadership, communication, and decision making skills to manage high impact incidents in a fast paced global environment.