Responsibilities
- Monitor and triage alerts across endpoint, network, cloud, runtime and identity data sources with accuracy and appropriate urgency
- Perform structured investigations on escalated or ambiguous alerts: pivot across log sources, correlate events, and build a coherent timeline
- Classify alerts correctly — true positive, false positive, or benign — with documented rationale, not just a verdict
- Identify scope and blast radius on confirmed incidents: affected users, systems, and data before escalating or containing
- Escalate to senior analysts with a complete investigation package — context, evidence, timeline, and a hypothesis
- Participate in active incident response under senior analyst or manager direction: evidence collection, log pulls, timeline reconstruction
- Execute containment actions — endpoint isolation, account suspension, token revocation — as directed with documented rationale
- Maintain accurate and timely case documentation throughout the incident lifecycle
- Contribute to post-incident timelines and assist with root cause documentation
- Monitor cloud audit logs and native threat detection findings for suspicious IAM activity, unusual API calls, and access anomalies
- Investigate identity provider events: suspicious logins, MFA bypass attempts, session anomalies, and unauthorized app assignments
- Recognize common cloud-native attack patterns: credential abuse via metadata service, privilege escalation via IAM role assumption, and storage misconfiguration access
- Correlate cloud-side events with endpoint and network telemetry to build a fuller picture of attacker activity
- Flag false positives and noisy detections with enough context for a senior analyst or detection engineer to tune them
- Identify gaps in existing detection coverage based on alert patterns you observe during triage
- Apply knowledge of MITRE ATT&CK to label attacker techniques and communicate findings consistently
- Contribute to runbook accuracy by flagging outdated steps or missing guidance encountered during investigations
- Participate with Detections Engineers to build detections and contribute to automating activity with an Engineering mindset
- Write clear, concise case notes that a colleague could pick up mid-investigation without needing to re-investigate from scratch
- Produce shift handoff summaries that accurately represent open cases, pending actions, and investigation status
- Communicate incident updates to the Security Operations Manager with sufficient clarity to brief upward without re-investigation
Requirements
- 2–4+ years of hands-on experience in a SOC, or security operations role with direct alert triage responsibility
- Solid understanding of the MITRE ATT&CK framework — you use it to label and communicate attacker behavior, not just reference it
- Working knowledge of EDR tooling: process tree analysis, behavioral detection review, and basic endpoint artifact interpretation
- Familiarity with SIEM-based investigation: querying logs, correlating events across sources, and building timelines from normalized data
- Understanding of foundational network protocols (TCP/IP, DNS, HTTP/S, TLS) and how attackers abuse them
- Exposure to cloud security monitoring ex. AWS or GCP — including audit log review and IAM-related alert investigation
- Experience investigating identity-based alerts in an enterprise identity provider (e.g., Okta, Entra ID, or equivalent)
- Strong written communication: your case notes are accurate, structured, and useful to someone who wasn’t there
Nice to Have
- Experience with next-gen EDR platforms (e.g., CrowdStrike Falcon, SentinelOne, or equivalent) beyond basic alert review — RTR, process trees, custom detections
- Hands-on SIEM experience with a cloud-native platform (e.g., Google SecOps/Chronicle, Microsoft Sentinel, or equivalent)
- Exposure to CSPM or cloud security tooling (e.g., Wiz, Prisma Cloud, or equivalent) as an investigation data source
- Familiarity with AWS IR fundamentals: CloudTrail, GuardDuty, VPC Flow Logs, IAM chain analysis
- Understanding of encoding vs. encryption vs. hashing and their relevance to attacker obfuscation techniques
- Experience working alongside or receiving escalations from a managed detection and response (MDR) partner
- Relevant certifications: CompTIA CySA+, Security+, BTL1, GCIH, or equivalent practical security credential
Work Arrangement
Remote (Country) — Canada
Additional Information
- Remote work within Canada
- Must be able to work in the Pacific time zone
- Fully remote role
