Security Operations Center Analyst

Job summary

Monitor security events and investigate suspected intrusions, compromises, suspicious activity, and member-reported incidents using SIEM tools, threat intelligence, and established playbooks. Provide mitigation guidance, escalate high-severity incidents, support member institutions through the incident lifecycle, and maintain investigative procedures and knowledge-base documentation.

Job details

Our Client is looking for analysts for overnight coverage (10pm-6:30am). They would monitor the client's 3 institution queue, doing initial triage, investigations in our platform and escalate Sev 1 and 2 incidents to our management team. Contract, approximately 2 months, with potential for extension or Conversion to full time Schedule: Overnight, 10:00 pm to 6:00 am ABT (Alberta time), including weekends and holidays Location: Remote within Canada, with preference for Calgary, Alberta residents This is a pure night shift hence if you are really interested then apply. Overnight, 10:00 pm to 6:00 am ABT (Alberta time) About the role Are you passionate about cybersecurity and eager to apply your technical and investigative skills for the public good? Our client is a not-for-profit agency whose mission is to improve the lives of Albertans through digital technologies. It serves the province’s education, research, and government sectors. To help the higher education sector defend against online harms, Client has established a regional Security Operations Centre (rSOC) to monitor, detect, and respond to cybersecurity threats. As a SOC Analyst on the night shift, you will respond to real incidents and make a real-world impact. You will work independently overnight, investigating incidents, managing escalations, and working with member institutions throughout the incident lifecycle. This is a contract role of approximately two months, with potential for extension based on business needs and performance What you’ll do Conduct proactive monitoring, investigation, and escalation of security incidents. Identify suspected intrusion attempts and compromises by analyzing event details and summary information. Investigate malicious URLs, domains, and IPs using open-source and sector intelligence. Provide mitigation guidance in response to identified threats, based on industry practices and vendor recommendations. Develop and refine investigative methods for anomalous or suspicious events, in collaboration with rSOC team members. Contribute to and maintain the knowledge base for rSOC processes and procedures. Use playbooks, guidelines, and a range of techniques to investigate incidents. Report gaps in log coverage, parsing issues, and high volumes of false positives. Act as first point of contact for member-reported security incidents and service requests, in line with established SLAs. Apply cybersecurity and privacy principles to meet organizational requirements. What you bring Education and experience Cybersecurity diploma or equivalent technical training. Atleast 5 to 6 years of SOC analyst experience in a demanding environment Certifications such as CompTIA Security+, CySA+, or similar are preferred. Hands-on experience through academic projects, Capture the Flag (CTF) competitions, or practical labs (e.g., HackTheBox, LetsDefend) is highly desirable. Familiarity with following documented cybersecurity processes, and a willingness to learn incident response workflows. Experience working night shifts or independently is an asset. Skills Understanding of cybersecurity threats and risks to the academic sector. Experience identifying and investigating security incidents. Practical understanding of incident response, vulnerability management, and IT service management. Technical proficiencies Experience with SIEM and UEBA technologies, and with following incident response playbooks. Understanding of the MITRE ATT&CK framework. Experience investigating suspicious sign-ins, phishing, malware, and network logs. Understanding of TCP/IP and other network protocols. Experience with threat intelligence feeds. Strong problem-solving, analytical, documentation, and communication skills, including the ability to explain technical information clearly to diverse audiences.

What you’ll do

Monitor security events and investigate suspected intrusions, compromises, suspicious activity, and member-reported incidents using SIEM tools, threat intelligence, and established playbooks. Provide mitigation guidance, escalate high-severity incidents, support member institutions through the incident lifecycle, and maintain investigative procedures and knowledge-base documentation.

Requirements

Requires a cybersecurity diploma or equivalent technical training and 5–6 years of SOC analyst experience; certifications such as CompTIA Security+ or CySA+ are preferred. Candidates should have experience with SIEM and UEBA, incident response, MITRE ATT&CK, network protocols and logs, and threat intelligence, along with strong analytical, documentation, and communication skills.

Listed skills

• TCP/IP · Preferred
• Problem solving · Preferred
• Documentation · Preferred
• Communication · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• Security Incident Monitoring
• Incident Investigation
• Incident Response
• Security Incident Escalation
• SIEM
• UEBA
• MITRE ATT&CK
• Threat Intelligence
• Phishing Investigation
• Malware Investigation
• Network Log Analysis
• TCP/IP
• Vulnerability Management
• Problem-Solving
• Documentation
• Communication

Job areas

• Security & Safety
• Technology
• Education

More jobs from OnX