Tier 2 Security Analyst - SOC

6 month contract + extension

Hybrid 4x per week in Mississauga

Pay: $40-50/hr incorp

Required Skills & Experience

• 2–3+ years of hands-on cybersecurity experience, ideally within a SOC, enterprise security operations or incident-response environment.
• Demonstrated experience investigating and responding to security incidents from initial alert through resolution.
• Experience working with an outsourced MDR or MSSP and handling security alerts/escalations.
• Understanding of SIEM technologies and security monitoring concepts.
• Familiarity with KQL or similar security-query languages.
• Understanding of endpoint, network, cloud and application security events.
• Exposure to application security and/or DevSecOps concepts, particularly security logging and monitoring.
• Ability to identify gaps in security tooling, monitoring or processes and recommend improvements.
• Strong ownership and accountability with the ability to operate independently.
• Strong written and verbal communication skills with the ability to communicate incidents to both technical and non-technical stakeholders.
• Microsoft SC-200 (Security Operations Analyst)

Strong foundational knowledge of the Microsoft security stack, particularly:

• Microsoft Defender
• Microsoft Sentinel
• Azure
• Entra ID
• Intune

Nice to Have Skills & Experience

• Experience working with Arctic Wolf or another MDR platform.
• Experience with Microsoft Sentinel configuration, connectors or analytics rules.
• Microsoft Purview / Data Loss Prevention experience.
• Application security experience with WordPress, .NET and/or Linux environments.
• Azure application and infrastructure security experience.
• Exposure to GitHub or Azure DevOps security tooling, including code scanning, dependency scanning and secrets management.
• Experience within manufacturing, distribution, logistics or another 24-hour operational environment.

Certifications

Additional certifications considered an asset:

Microsoft AZ-500

Microsoft SC-100

CompTIA Security+ or CySA+

GIAC GCIH / GCIA

Job Description

Insight Global is looking for a hands-on Cyber Security Analyst to join a growing security team. This individual will play a key role in day-to-day security operations, incident response, MDR provider management, and the continued maturation of the organization's security program.

The successful candidate will have a strong SOC / incident response background and hands-on experience within the Microsoft security ecosystem, including Defender, Azure, Sentinel, Entra ID, and Intune. This person should be comfortable taking ownership of security incidents, working with an outsourced MDR provider, identifying gaps in monitoring and tooling, and helping move the security practice toward a more mature future state.

This is not a governance-focused role. The ideal candidate is technically curious, accountable, and capable of looking beyond individual tickets to identify opportunities to improve the overall security environment.

Key Responsibilities

Incident Response & Security Operations

• Own and manage the Tier 2 security incident queue, including triage, prioritization, investigation, containment, and closure.
• Manage approximately 5–7 day-to-day security tickets/incidents, while using additional capacity to improve SOC processes and security capabilities.
• Act as an escalation point for alerts generated by the MDR provider and internal service desk.
• Determine the validity and business impact of security incidents and escalate critical issues appropriately.
• Coordinate containment activities with IT and infrastructure teams, including account disabling, endpoint isolation and blocking.
• Maintain clear incident documentation, response playbooks and operational metrics.
• Identify gaps in monitoring, alerting and incident-response processes and recommend improvements.

MDR / MSSP Management

• Act as the day-to-day technical contact for the organization's Managed Detection and Response (MDR) provider.
• Review and challenge MDR escalations to ensure alerts are actionable and meet agreed-upon SLAs.
• Track MDR recommendations and incidents through resolution.
• Validate monitoring and tooling coverage across endpoints, network, cloud and applications.
• Help measure MDR performance and identify opportunities to mature the relationship and security practice.
• Microsoft Security & Cloud
• Work hands-on across the Microsoft security ecosystem, including:
• Microsoft Defender XDR
• Microsoft Sentinel
• Microsoft Entra ID
• Microsoft Intune
• Microsoft Purview / DLP

Azure security tooling

• Perform security investigations, alert analysis and threat hunting.
• Review risky sign-ins, device compliance, endpoint activity and cloud security events.
• Support Sentinel capabilities including data connectors, analytics rules, workbooks and KQL-based investigations.
• Assist with the organization's continued consolidation and maturation of its Microsoft security environment.

Application Security & DevSecOps

• Partner with infrastructure and application-development teams to ensure sufficient security monitoring exists across both infrastructure and application layers.
• Understand differences in security monitoring requirements across technologies such as Linux, .NET and WordPress applications.
• Review security requirements for Azure-hosted workloads and web applications.
• Support secure software-development practices such as code scanning, dependency scanning, secrets management and application logging.
• Help identify gaps in application-layer monitoring and recommend appropriate controls and alerts.
• Contribute to incident-response playbooks for threats including phishing, compromised accounts, ransomware precursors and web application attacks.

Artificial intelligence tools are used to assist in screening and assessing applicants for this position.

Vacancy: This posting is for a currently vacant role, and the successful candidate will be hired into an existing open position.