SOC Analyst
- Canada
Full-time
Applications open in a new tab.
Job details
- Job type
- Full-time
- Posting language
- English
- Posted
Original job description
Roles and Responsibilities
- Monitor security events and alerts using Security Information and Event Management (SIEM) tools.
- Analyze security logs from firewalls, servers, endpoints, and network devices.
- Identify and investigate suspicious activities, potential threats, and security incidents.
- Perform initial alert triage, classification, and prioritization based on severity.
- Investigate phishing attacks, malware infections, brute-force attempts, and unauthorized access.
- Analyze IP addresses, URLs, domains, and file hashes to identify potentially malicious indicators.
- Monitor endpoint security alerts using Endpoint Detection and Response (EDR) tools.
- Escalate high-priority and critical security incidents to L2/L3 security teams.
- Create, update, and maintain security incident tickets and investigation reports.
- Follow established incident response procedures, security policies, and standard operating procedures.
- Perform basic threat intelligence research and IOC analysis.
- Collaborate with internal IT and security teams to support incident resolution.
- Maintain accurate documentation of security events and investigation findings.
Technical Skills Required
Networking Fundamentals
- TCP/IP, DNS, DHCP, HTTP, HTTPS, and VPN.
- Basic understanding of network ports and protocols.
- Knowledge of firewalls, IDS, and IPS.
Security Fundamentals
- Understanding of malware, ransomware, phishing, and social engineering.
- Knowledge of vulnerabilities, threats, and security risks.
- Understanding of authentication and access control.
- Basic knowledge of incident response processes.
SIEM Tools
- Splunk
- IBM QRadar
- Microsoft Sentinel
Operating Systems
- Windows operating system.
- Linux fundamentals.
- Windows Event Logs and Linux Syslogs.
Security Frameworks
- MITRE ATT&CK Framework.
- Cyber Kill Chain.
- Basic understanding of the CIA Triad.
Tools and Technologies
- SIEM: Splunk, IBM QRadar, Microsoft Sentinel.
- EDR: CrowdStrike Falcon, Microsoft Defender for Endpoint.
- Network Analysis: Wireshark.
- Threat Intelligence: VirusTotal, AbuseIPDB.
- Ticketing Tools: ServiceNow, Jira.
- Security Technologies: Firewall, IDS, IPS, Antivirus.
More about this job
Responsibilities
Monitor and analyze security alerts, logs, and endpoint activity to identify, investigate, classify, and prioritize potential threats and incidents. Document investigations, maintain incident tickets and reports, follow response procedures, and escalate critical incidents while collaborating with IT and security teams.
Requirements
The role requires foundational knowledge of networking, security threats, access control, incident response, Windows and Linux logs, and security frameworks such as MITRE ATT&CK and the Cyber Kill Chain. Familiarity with SIEM, EDR, network analysis, threat intelligence, and ticketing tools is expected.
Skills
- Security Event Monitoring
- SIEM
- Security Log Analysis
- Incident Triage
- Incident Response
- Threat Analysis
- Phishing Investigation
- Malware Analysis
- EDR
- Threat Intelligence
- Network Fundamentals
- Firewalls
- IDS/IPS
- Windows
- Linux
- MITRE ATT&CK
Visa sponsorship
Not detected in the job text
Categories
- Security & Safety
- Technology
- Software
Keywords
- SIEM
- Splunk
- IBM QRadar
- Microsoft Sentinel
- EDR
- CrowdStrike Falcon
- Microsoft Defender for Endpoint
- Wireshark
- VirusTotal
- AbuseIPDB
- ServiceNow
- Jira
- TCP/IP
- DNS
- DHCP
- HTTP
- HTTPS
- VPN
- Firewalls
- IDS
- IPS
- Windows Event Logs
- Linux Syslogs
- MITRE ATT&CK
- Cyber Kill Chain
- CIA Triad
- Incident Response
- Threat Intelligence
- IOC Analysis
- Phishing