Security Operations Analyst II

🕒 August 20

🇨🇦 Canada – Remote

💵 $65k - $90k / year

⏰ Full Time

🟢 Junior

🟡 Mid-level

🛡️ Security Operations

🚫👨‍🎓 No degree required

👻 Ghost score 19%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

AlphaSense

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2011

💼 Consulting

🏥 Healthcare

📣 Marketing

💰 Debt Financing on 2022-06

Consulting • Healthcare • Marketing

AlphaSense is a market intelligence and search platform that empowers companies to unlock critical insights across an extensive universe of public and private content, including company filings, broker research, expert calls, and market trends. Its AI-driven technology affords users the ability to conduct comprehensive due diligence with speed and accuracy, reducing uncertainty and blind spots in decision-making. Trusted by major corporations, financial institutions, and asset management firms globally, AlphaSense serves sectors such as financial services, health care, and technology by providing generative AI-powered solutions that integrate internal proprietary data with external premium content.

📋 Description

• Monitor and triage alerts across endpoint, network, cloud, runtime, and identity data sources • Perform structured investigations on escalated or ambiguous alerts by pivoting across log sources, correlating events, and building timelines • Classify alerts as true positive, false positive, or benign with documented rationale • Identify scope and blast radius on confirmed incidents • Escalate complete investigation packages to senior analysts • Participate in incident response through evidence collection, log pulls, and timeline reconstruction • Execute directed containment actions including endpoint isolation, account suspension, and token revocation • Maintain case documentation throughout the incident lifecycle • Contribute to post-incident timelines and root cause documentation • Monitor cloud audit logs and threat detection findings for suspicious IAM activity, unusual API calls, and access anomalies • Investigate identity provider events including suspicious logins, MFA bypass attempts, session anomalies, and unauthorized app assignments • Recognize cloud-native attack patterns and correlate cloud events with endpoint and network telemetry • Flag false positives and noisy detections for tuning • Identify detection coverage gaps and apply MITRE ATT&CK labels • Flag outdated or missing runbook guidance • Participate with Detection Engineers to build detections and automate activity • Write case notes and produce shift handoff summaries • Communicate incident updates to the Security Operations Manager

🎯 Requirements

• 2–4+ years of hands-on experience in a SOC, or security operations role with direct alert triage responsibility • Solid understanding of the MITRE ATT&CK framework • Working knowledge of EDR tooling: process tree analysis, behavioral detection review, and basic endpoint artifact interpretation • Familiarity with SIEM-based investigation: querying logs, correlating events across sources, and building timelines from normalized data • Understanding of foundational network protocols (TCP/IP, DNS, HTTP/S, TLS) and how attackers abuse them • Exposure to cloud security monitoring, such as AWS or GCP, including audit log review and IAM-related alert investigation • Experience investigating identity-based alerts in an enterprise identity provider, such as Okta, Entra ID, or equivalent • Strong written communication • Preferred: experience with next-gen EDR platforms such as CrowdStrike Falcon or SentinelOne • Preferred: hands-on SIEM experience with a cloud-native platform such as Google SecOps/Chronicle or Microsoft Sentinel • Preferred: exposure to CSPM or cloud security tooling such as Wiz or Prisma Cloud • Preferred: familiarity with AWS IR fundamentals, including CloudTrail, GuardDuty, VPC Flow Logs, and IAM chain analysis • Preferred: understanding of encoding, encryption, hashing, and attacker obfuscation techniques • Preferred: experience alongside or receiving escalations from an MDR partner • Preferred: relevant certifications such as CompTIA CySA+, Security+, BTL1, or GCIH

🏖️ Benefits

• Performance-based bonus • Equity • Generous benefits program • AlphaSense never asks candidates to pay for job applications, equipment, or training

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume