About the Company
CYBERWELL is the new name behind North America’s most trusted cybersecurity brands – Source44, Seekintoo, Cycura, and Proack Security. Now under one banner, we’re scaling our impact with a fresh vision, a stronger portfolio, and a renewed commitment to helping organizations build lasting resilience in today’s evolving threat landscape. In today’s threat landscape, complexity is the constant. At CYBERWELL, we’re built to help organizations not just keep up but get ahead. CYBERWELL is a cybersecurity company purpose built for scale, change, and the realities of modern enterprise. We deliver integrated solution that span the full cybersecurity lifecycle-from offensive security exposure management to GRC, architecture and engineering, threat intelligence, and 24/7 managed detection and response. We partner with enterprise leaders who are navigating regulatory pressure, evolving risk, and growing infrastructure. Whether it's a healthcare provider safeguarding patient data, a government agency defending critical systems, or a tech or financial firm scaling securely - our team helps unify strategy, reduce complexity, and strengthen cyber resilience. Why it matters: Cybersecurity isn't just a technical issue - it’s a business imperative. From compliance and operational uptime to reputation and trust, we help organizations protect what matters most, stay ahead of threats, and build the foundation for long-term success. We're not just another vendor. We're your cybersecurity partner - relentlessly focused on outcomes, backed by world-class talent, and obsessed with your success.
About the Role
The SOC Analyst – Tier 2 is a key escalation and incident response role within the CYBERWELL CYBERSOC. You will investigate complex security events across multiple client environments, validate and scope potential incidents, execute authorized containment actions, and provide clear technical guidance to Tier 1 analysts.
This role is well suited to an analyst who is comfortable working independently, making sound decisions under pressure, and moving beyond initial alert triage into deeper investigation and response. You will work across technologies including Microsoft Sentinel, Cortex XSOAR, EDR/XDR, network security platforms, and cloud environments while supporting government and highly regulated clients.
Following onboarding and training, this position will primarily support our night shift as part of CYBERWELL’s 24/7/365 security operations model. You will play an important role in strengthening overnight escalation coverage and ensuring complex incidents can be investigated and acted on without waiting for daytime resources.
Key Responsibilities:
- Investigate escalated security alerts and incidents across SIEM, SOAR, EDR/XDR, identity, network, and cloud security platforms
- Perform advanced investigation and correlation using logs, endpoint telemetry, threat intelligence, and other available data sources
- Determine incident scope, severity, impact, and required response actions using sound technical judgment and client-specific procedures
- Execute authorized containment and response actions, including host isolation, account or session containment, and other approved measures in accordance with client-specific SOPs
- Own escalated cases through resolution, client escalation, or structured handoff, ensuring analysis and actions are complete and defensible
- Act as an escalation point for Tier 1 analysts, providing investigative guidance, escalation review, and coaching to improve case quality
- Maintain detailed, high-quality case documentation and produce clear client-facing notes describing findings, impact, actions taken, and next steps
- Participate in incident calls and client interactions as a technical subject matter contributor when required
- Maintain situational awareness across multiple concurrent incidents and client environments, including during overnight operations
- Contribute to continuous improvement of playbooks, runbooks, detection fidelity, response procedures, and operational workflows
Qualifications:
- 3–4 years of experience in a SOC, incident response, or cybersecurity operations environment, with demonstrated experience performing advanced security investigations (Essential)
- Experience in an MSSP or multi-tenant environment is strongly preferred
- Hands-on experience with:
- SIEM platforms and investigative query workflows (Microsoft Sentinel and KQL preferred)
- SOAR platforms and response automation (Cortex XSOAR preferred)
- EDR/XDR, identity, network security tools, and log analysis workflows
Working knowledge of:
- TCP/IP networking, Windows/Linux security fundamentals, and authentication workflows
- Common attack techniques, indicators of compromise, and incident response / containment practices
- MITRE ATT&CK framework and practical application during investigation
- Ability to work independently, prioritize concurrent incidents, and make sound escalation and containment decisions within defined authority
- Strong written and verbal communication skills with an emphasis on clear, precise, and defensible analysis
Preferred Certifications:
- CompTIA CySA+ or Security+
- Microsoft SC-200, SC-100, SC-300, or SC-500 are preferred
- ISC² SSCP, GIAC GCIH, or equivalent security operations / incident response certification
Work Requirements:
- Participation in a 24/7/365 coverage model, with primary assignment to night shift following completion of onboarding and training
- Training and onboarding may be completed on day or evening shifts before transition to the primary night-shift schedule
- Must be a Canadian Citizen, Permanent Resident or eligible to work in Canada
- Must be eligible to obtain and maintain required security clearances
- Ability to operate effectively and independently in a high-volume environment, including periods with limited overnight supervision
Pay range and compensation package
The salary offered for this position falls within a specified salary range and will be determined based on a variety of factors, including but not limited to the candidate's experience, qualifications, skills, and the specific needs of the organization.
There are shift premiums for evening and night shifts included.
Benefits
CYBERWELL offers a comprehensive benefits package, including:
- Life insurance
- Accidental Death and Dismemberment (AD&D) insurance
- Extended health and dental coverage
- Long-term disability coverage
The salary offered for this position falls within a specified salary range and will be determined based on a variety of factors, including but not limited to the candidate's experience, qualifications, skills, and the specific needs of the organization.
At WELL, we believe in fair and equitable compensation, and our goal is to offer a competitive salary that reflects the value and expertise of the selected candidate.
WELL is committed to supporting a diverse, inclusive, and accessible workplace. We welcome and celebrate the diversity of applicants and team members across ability, race, gender identity, sexual orientation, and perspective. We strive to create an inclusive workplace where differences are celebrated and fuel our success – this is the WELL Way!
WELL has been independently certified as a Great Place to Work® by Great Place to Work Institute® Canada, an achievement that reflects the company’s strong commitment to creating a workplace culture centered on trust, inclusivity, and employee well-being, aligning with its ‘Healthy Place to Work’ ESG strategy pillar. Want Read more about us: https://stories.well.company/
