Bell Cyber is seeking a Senior CIC Analyst to join our Cyber Intelligence Centre as a technical escalation point for complex security incidents.
You will lead investigations across customer environments, coordinate incident handling from assessment through closure and build strong operational relationships with assigned customers. You will also improve detection use cases, develop security automation and mentor analysts.
What you’ll do
- Lead investigations into complex, ambiguous or high-severity alerts across SIEM, endpoint, identity, network, email and cloud technologies.
- Correlate telemetry to determine affected assets, attack paths, incident timelines and potential business impact.
- Own assigned incidents through investigation, authorized containment, recovery coordination and closure.
- Lead technical incident discussions and communicate confirmed findings, uncertainties and next steps.
- Serve as an operational security contact for assigned customers, participate in service reviews and track agreed actions through resolution.
- Tune detection rules, queries, thresholds and correlation logic to reduce unnecessary alerts while preserving detection coverage.
- Design, test and improve automation workflows, integrations and investigation scripts, with appropriate approvals and human oversight.
- Lead focused threat hunts and translate findings into repeatable detections and procedures.
- Mentor analysts, review investigation quality and contribute to post-incident reviews and knowledge sharing.
- Maintain clear incident records and ensure changes follow testing, approval and documentation requirements.
What you bring
- Post-secondary education in cybersecurity, information technology, computer science or a related discipline, or an equivalent combination of education, training and experience.
- Typically three to five years of relevant cybersecurity experience, including hands-on SOC investigations and incident handling.
- Demonstrated ability to independently investigate complex incidents across multiple technologies and data sources.
- Experience coordinating incident response and communicating directly with customers or business stakeholders.
- Practical experience tuning SIEM detection rules and reducing false positives.
- Experience developing or enhancing security automation, orchestration workflows or investigation scripts.
- Strong understanding of operating systems, networking, authentication, cloud services and attacker techniques.
- Strong communication and mentoring skills, with sound judgment under pressure.
- The ability to assess operational impact and work within customer authorization and escalation requirements.
Technical experience
Relevant technologies and skills include:
- SIEM and analytics: Microsoft Sentinel, Splunk, Elastic Security, FortiSIEM, Cortex XSIAM or IBM QRadar.
- Endpoint and XDR: Microsoft Defender XDR, CrowdStrike Falcon, SentinelOne, FortiEDR or Sophos.
- Automation: Cortex XSOAR, FortiSOAR, Microsoft Logic Apps, APIs and integrations.
- Identity and cloud: Active Directory, Entra ID, and Azure, AWS or Google Cloud telemetry.
- Querying and scripting: KQL, XQL, SPL, PowerShell or Python.
Strong hands-on capability and the ability to transfer your knowledge across platforms matter more than experience with every product listed.
Additional assets
Experience in an MSSP or multi-tenant SOC; customer security reviews; major incident handling; threat hunting; forensic or malware investigations; detection validation or purple-team exercises; and evaluating AI-assisted investigation workflows.
Certifications such as CySA+, SC-200, GCIH, GCIA, GCFA, CISSP or relevant SIEM, SOAR and endpoint credentials are assets.
Work environment
Our Cyber Intelligence Centre operates 24/7/365, and shifts may include evenings, nights, weekends and statutory holidays.
Salary Range: $90,000 to $115,000 per year
Bell Cyber welcomes applications from qualified candidates with diverse backgrounds and experiences. Accommodations are available upon request throughout the recruitment process.
