Security Operations Analyst II

Role overview Join a security operations team handling alert triage, structured investigations, and incident response support. At this intermediate tier, you will work with endpoint, network, cloud, runtime, and identity signals, taking increasing ownership of cases while coordinating with senior analysts and improving detection quality. The position is fully remote within Canada and requires availability to work in the Pacific time zone.

Responsibilities - Triage alerts, correlate activity across log sources, build timelines, and document why findings are true positive, false positive, or benign. - Assess incident scope, prepare evidence and investigation summaries, and escalate cases with context and a working hypothesis. - Support incident response through evidence collection, log review, timeline reconstruction, and directed containment actions. - Monitor cloud audit and identity events for suspicious access, unusual API activity, privilege changes, and other attack patterns. - Use endpoint, network, and cloud telemetry together to understand potential attacker activity. - Flag noisy detections and runbook gaps, apply MITRE ATT&CK labels, and provide clear case notes and shift handoffs.

Requirements - 2–4 or more years in a SOC or security operations role with direct alert triage duties. - Practical understanding of MITRE ATT&CK for describing and classifying attacker behavior. - Working knowledge of EDR investigations, including process trees, behavioral alerts, and basic endpoint artifacts. - Experience querying SIEM data, correlating events across sources, and building investigation timelines. - Understanding of TCP/IP, DNS, HTTP/S, and TLS, including common forms of abuse. - Exposure to AWS or GCP security monitoring and enterprise identity alerts, plus strong written documentation skills.

Nice to have - Advanced use of an EDR platform, including remote response, process analysis, or custom detections. - Experience with a cloud-native SIEM, CSPM tools, or AWS incident response data such as CloudTrail, GuardDuty, and VPC Flow Logs. - Familiarity with MDR partners and with how encoding, encryption, and hashing relate to attacker obfuscation. - Certifications such as CySA+, Security+, BTL1, or GCIH, or equivalent practical credentials.

Benefits and work setup Fully remote within Canada, with work aligned to Pacific time.