AI-focused Incident Response Contractor

BMO is currently sourcing for an AI-focused Incident Response Contractor. This is a hybrid contract role in Toronto (2 days in office per week).
Role Overview:
This role supports the Incident Response organization’s AI initiatives by developing, evaluating, and operationalizing AI-assisted and agentic cybersecurity workflows. The work involves building and testing AI workflows that enhance investigation efficiency, automate analyst activities, and improve security operations. The position requires a strong cybersecurity background combined with practical experience in AI workflow development and emerging AI technologies.
Key Responsibilities:

Design, prototype, and evaluate agentic AI workflows for Incident Response use cases such as alert triage, investigation planning, and evidence summarization.
Build AI-enabled workflow prototypes using frameworks like LangGraph, LangChain, Semantic Kernel, AutoGen, CrewAI, and OpenAI Assistants/Agents SDKs.
Develop structured agent workflows involving tool calling, retrieval-augmented generation, multi-step reasoning, and human-in-the-loop review.
Create and maintain evaluation methods for AI-assisted security workflows including prompt testing, backtesting, and error analysis.
Support AI workflow observability and auditability by logging inputs, outputs, prompts, model selections, and reviewer decisions.
Document system behavior, workflow assumptions, failure modes, guardrails, and escalation criteria to translate prototypes into operational capabilities.
Collaborate with technology partners to integrate AI workflows with security platforms such as SIEM, SOAR, EDR, case management, and threat intelligence systems.

Must-Have Skills:

7+ years of cybersecurity experience in Incident Response, threat detection, investigations, digital forensics, or security operations.
Practical experience with security operations workflows including alert triage, event enrichment, escalation decisioning, and incident reporting.
Hands-on experience designing, building, or evaluating AI-assisted workflows, agentic workflows, or LLM-based applications.
Familiarity with agentic AI concepts such as tool calling, workflow orchestration, multi-step task execution, and human-in-the-loop review.
Experience with AI/agent development frameworks or SDKs like LangGraph, LangChain, Semantic Kernel, AutoGen, CrewAI, OpenAI Assistants/Agents SDKs, or GitHub Copilot SDK.
Proficiency in scripting and development using Python, PowerShell, SQL, JSON/YAML, REST APIs, notebooks, or Git-based workflows.
Experience working with structured security data such as logs, alerts, detection outputs, case records, and investigation notes.
Familiarity with security operations tools including SIEM, EDR, SOAR, case management, threat intelligence platforms, and enrichment APIs.
Understanding of AI workflow evaluation methods including ground-truth comparison, false positive/negative review, confidence scoring, and regression testing.
Strong analytical skills to validate AI outputs, identify errors, and balance speed with investigative rigor.
Strong written communication skills for producing clear documentation, technical notes, and governance materials.
Ability to collaborate with Incident Response leadership, analysts, SMEs, and technology partners to develop controlled AI workflows.

Nice to Have Skills:

Professional security certifications such as CISSP, GCIH, GCFA, GCFE, or GCFR.
Relevant postsecondary education.

Ideal Candidate:

Experience working independently within a small team while maintaining strong collaboration across Incident Response functions.
Proven ability to translate operational needs into practical, measurable AI-enabled security workflows.
Familiarity with operationalizing AI prototypes into defensible, auditable security capabilities.
Comfortable working in a hybrid environment with flexibility for remote work.