Security Operations Analyst II

Job not on LinkedIn

🔥 0 minutes ago

🇨🇦 Canada – Remote

⏰ Full Time

🟢 Junior

🟡 Mid-level

🛡️ Security Operations

🚫👨‍🎓 No degree required

👻 Ghost score 10%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

AlphaSense

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2011

💼 Consulting

🏥 Healthcare

📣 Marketing

💰 Debt Financing on 2022-06

Consulting • Healthcare • Marketing

AlphaSense is a market intelligence and search platform that empowers companies to unlock critical insights across an extensive universe of public and private content, including company filings, broker research, expert calls, and market trends. Its AI-driven technology affords users the ability to conduct comprehensive due diligence with speed and accuracy, reducing uncertainty and blind spots in decision-making. Trusted by major corporations, financial institutions, and asset management firms globally, AlphaSense serves sectors such as financial services, health care, and technology by providing generative AI-powered solutions that integrate internal proprietary data with external premium content.

📋 Description

• Monitor and triage alerts across endpoint, network, cloud, runtime, and identity data sources • Perform structured investigations on escalated or ambiguous alerts by pivoting across logs, correlating events, and building timelines • Classify alerts as true positive, false positive, or benign with documented rationale • Identify incident scope and blast radius, including affected users, systems, and data • Escalate complete investigation packages to senior analysts • Participate in incident response, including evidence collection, log pulls, and timeline reconstruction • Execute directed containment actions such as endpoint isolation, account suspension, and token revocation • Maintain case documentation throughout the incident lifecycle • Contribute to post-incident timelines and root cause documentation • Monitor cloud audit logs and threat detection findings for suspicious IAM activity, unusual API calls, and access anomalies • Investigate identity provider events including suspicious logins, MFA bypass attempts, session anomalies, and unauthorized app assignments • Correlate cloud events with endpoint and network telemetry • Flag false positives, identify detection coverage gaps, and contribute to detection tuning • Apply MITRE ATT&CK to label attacker techniques • Flag outdated runbook steps or missing investigation guidance • Participate with Detection Engineers to build detections and automate activity • Write clear case notes and produce shift handoff summaries • Communicate incident updates to the Security Operations Manager

🎯 Requirements

• 2–4+ years of hands-on experience in a SOC or security operations role with direct alert triage responsibility • Solid understanding of the MITRE ATT&CK framework • Working knowledge of EDR tooling, including process tree analysis, behavioral detection review, and basic endpoint artifact interpretation • Familiarity with SIEM-based investigation, including querying logs, correlating events across sources, and building timelines from normalized data • Understanding of TCP/IP, DNS, HTTP/S, and TLS and how attackers abuse them • Exposure to cloud security monitoring, such as AWS or GCP, including audit log review and IAM-related alert investigation • Experience investigating identity-based alerts in an enterprise identity provider such as Okta or Entra ID • Strong written communication and structured case documentation • Preferred: experience with CrowdStrike Falcon, SentinelOne, or equivalent beyond basic alert review • Preferred: hands-on experience with Google SecOps/Chronicle, Microsoft Sentinel, or equivalent • Preferred: exposure to CSPM or cloud security tooling such as Wiz or Prisma Cloud • Preferred: familiarity with AWS IR fundamentals, including CloudTrail, GuardDuty, VPC Flow Logs, and IAM chain analysis • Preferred: understanding of encoding, encryption, hashing, and attacker obfuscation techniques • Preferred: experience with an MDR partner • Preferred: CompTIA CySA+, Security+, BTL1, GCIH, or equivalent practical security credential

🏖️ Benefits

• Fully remote capacity from Canada • Ability to work in the Pacific time zone • Reasonable accommodation for qualified employees with protected disabilities, as required by applicable laws • Equal-opportunity employment commitment