Investigates and qualifies escalated SOC alerts involving phishing, account compromise, malware, and lateral movement. Correlates events across security platforms, enriches investigations with logs, indicators of compromise, and threat intelligence, determines severity and impact, and recommends or initiates mitigation and escalation actions. Documents findings, analyzes endpoint and network artifacts, coaches Level 1 analysts, improves detection rules and playbooks, and uses approved automation and AI tools.
Overview:
- The client is looking for an IT security analyst for its
SOC, positioned at level 2: alerts reach this person already escalated by level
1, and the person in turn acts as the technical escalation point for those
analysts.
- The work centres on investigation: qualifying phishing,
account compromise, malware or lateral movement cases, correlating events
across several platforms, then enriching them with logs, indicators of
compromise and threat intelligence.
- The person determines verdict, severity and impact, then
recommends or initiates first measures according to established processes, with
incident response remaining initial and carried out with other teams.
- The form title specifies no level, while the full set of
responsibilities describes a level 2 role.
- The Talents and qualifications section is empty: no degree,
certification, language or named tool is required, so assessment rests entirely
on the activity profile.
- Target candidate: a QA professional with at least 10 years
in IT, including 5 years in testing, who has coordinated testing within agile
teams and uses JIRA, XRAY, Cypress and Playwright in recent mandates.
- Group insurance exposure or an integration project will set
apart otherwise equal candidates.
Requirements
Required:
- Analysis and qualification of escalated alerts (phishing,
account compromise, malware, lateral movement)
- Event correlation (SIEM, XDR, EDR, identity, email, network,
cloud)
- Alert enrichment (logs, indicators of compromise, threat
intelligence)
- Determination of verdict, severity, potential impact and
required actions
- Initial mitigation, containment or escalation measures,
recommended or initiated per processes
- Documentation of investigations, findings, decisions and
actions
- First-level technical analysis of endpoint and network logs
and artefacts
- Support and coaching of level 1 SOC analysts on complex
cases
- Improvement of detection rules, investigation queries,
runbooks and playbooks
- Use of approved AI and automation tools (triage, enrichment,
documentation)
Similar Jobs
Cloud • Security • Software • Cybersecurity • Automation
Designs, operates, and improves production Kubernetes platforms across cloud environments. Manages ArgoCD GitOps workflows, Terraform infrastructure, CI/CD integrations, platform reliability, observability, security controls, and developer enablement. Collaborates with application teams to onboard services, create self-service tooling and documentation, respond to incidents, and improve platform availability and performance.
Top Skills:
ArgocdAWSAzureBashCiliumCrossplaneDnsExternal Secrets OperatorGCPGithub ActionsGitlab CiGitopsGoGrafanaHelmIngressIstioKubernetesKyvernoLinkerdLoad BalancingLokiOpa/GatekeeperOpentelemetryPrometheusPythonSealed SecretsService MeshTektonTerraformVault
Cloud • Information Technology • Productivity • Security • Software • App development • Automation
Build and operate end-to-end full-stack features for Loom billing, subscriptions, integrations, and platform migrations. Develop responsive React interfaces, scalable backend APIs and microservices, payment and identity integrations, and reliable cloud-based systems. Responsibilities include observability, monitoring, testing, code reviews, documentation, security, performance optimization, and participation in Agile ceremonies and technical design reviews.
Top Skills:
AWSBitbucketCi/CdConfluenceCypressDockerGitJavaJavaScriptJestJIRAMicroservicesMochaMySQLNode.jsPostgresPythonReactRest ApisTypescript
Artificial Intelligence • Cloud • Computer Vision • Hardware • Internet of Things • Software
Sell Samsara’s IoT solutions to mid-market customers across the Western U.S. Responsibilities include prospecting, building pipeline, managing proofs of concept and trials, coordinating multiple stakeholders, negotiating complex pricing, and closing $20,000–$100,000 deals with executives and CXOs. The role requires full-cycle sales experience, quota achievement, cold calling, collaborative selling, and approximately 25% travel.
Top Skills:
Internet Of Things (Iot)Salesforce (Sfdc)
What you need to know about the Toronto Tech Scene
Although home to some of the biggest names in tech, including Google, Microsoft and Amazon, Toronto has established itself as one of the largest startup ecosystems in the world. And with over 2,000 startups — more than 30 percent of the country's total startups — Toronto continues to attract new businesses. Be it helping entrepreneurs manage their finances, simplifying business operations by automating payroll or assisting pharmaceutical companies in launching new drugs, the city's tech scene is just getting started.
