Lead Security Analyst - SOAR

Waterloo, ON
On-site
Posted Oct 9, 2026
1 position

$110,960–$160,960 / year

Opens an external site

Experience level: Senior · 5+ years
Minimum education: Professional degree
Posting language: English
Working hours: 40 hours per week

Job summary

The Lead Security Analyst designs, builds, and supports security orchestration, automated response, and AI-enabled security workflows. This role collaborates with cross-functional teams to identify automation opportunities and ensure workflows are reliable, maintainable, and production-ready.

Job details

Hiring Manager: Mike Kolasa Talent Acquisition Advisor: Jess Bougie Job Code Level: IYP4 Refer Your Friends! AI-First. Future-Driven. Human-Centered. At OpenText, AI is at the heart of everything we do—powering innovation, transforming work, and empowering digital knowledge workers. We are hiring talent AI can't replace to help us shape the future of information management. Join us. **Must be eligible to obtain and maintain a Government of Canada Secret security clearance. Eligibility requirements for the clearance are established by the Government of Canada and may include Canadian citizenship. Global Information Security (GIS) leverages our people, processes and technology to develop new digitalization efforts that ensure our enterprise systems’ reliability, minimize staff interaction, and most importantly, protect our customers’ data. Companies are recognizing the need to digitize information and manage alternative work scenarios in today’s changing reality. With this in mind, we work tirelessly to drive improvements across our security services and accelerate our customers’ digital journey in a safe and trusted environment. Security Operations is the team that handles day to day protection of our environment and the tools that support them. This team takes care of identifying security weaknesses and facilitates remediation efforts. Additionally, this team monitors networks to assesses abnormal behaviors and manages security incidents to allow for execution of response processes. Your Impact: The Lead Security Analyst - SOAR is a senior technical lead responsible for designing, building, and supporting security orchestration, automated response, and AI-enabled security workflows. This role develops reliable automation using Python, Jinja, REST APIs, and security orchestration platforms to reduce manual incident response effort and improve security operations efficiency. The role works closely with security analysts, incident responders, detection engineers, and security tool owners to identify automation opportunities, guide playbook design, support responsible AI-enabled automation, and ensure workflows are reliable, maintainable, and ready for production use. What the role offers: As a Lead Security Analyst, you will: Design, develop, and maintain automated security playbooks for alert triage, enrichment, investigation, response, notification, and ticketing. Build custom integrations, parsers, and data transformation routines using Python and Jinja to enable scalable security automation. Integrate SIEM, EDR, threat intelligence, firewall, case management, and ticketing platforms through REST APIs and supported connectors. Monitor, troubleshoot, test, and optimize security automation workflows to improve reliability, performance, and alert handling efficiency. Collaborate with security analysts and operational teams to identify, streamline, and automate manual security processes. Debug code, enhance workflow execution, and maintain automation logic aligned with operational and incident response requirements. Support the responsible adoption of AI and agentic AI capabilities for triage, enrichment, recommendations, analyst productivity, and human-reviewed response actions Drive automation best practices through consistent playbook design, testing, documentation, runbooks, change management, and support for SOC, incident response, threat intelligence, detection engineering, and vulnerability management workflows. What you need to Succeed: Strong hands-on experience developing security automation using Python, Jinja, REST APIs, and structured data formats. Experience integrating security orchestration, monitoring, endpoint security, network security, threat intelligence, ticketing, and case management platforms. Solid understanding of TCP/IP, DNS, HTTPS, and common network protocols used in security investigations and automation workflows. Proven ability to troubleshoot complex automation issues, debug code, optimize workflows, and improve operational efficiency. Experience documenting workflows, maintaining version-controlled logic, testing playbooks, and supporting reliable production operations. Strong collaboration and communication skills, with the ability to translate operational requirements into practical automation solutions. Proactive mindset focused on continuous improvement, reducing manual response efforts, and enhancing incident response consistency. Bachelor's degree or equivalent experience with 5+ years in cybersecurity, security engineering, automation engineering, or security operations; preferred certifications include Security+, CISSP, GCIH, GCIA, and related cloud security, automation, SOAR, or AI/ML credentials. One last thing: OpenText is more than just a corporation, it's a global community where trust is foundational, the bar is raised, and outcomes are owned. Join us on our mission to drive positive change through privacy, technology, and collaboration. At OpenText, we don't just have a culture; we have character. Choose us because you want to be part of a company that embraces innovation and empowers its employees to make a difference. OpenText's commitment to diversity and inclusion surpasses legal requirements, evident in our Equal Employment Opportunity Statement of Policy which promotes a respectful and empowering environment for employees of all backgrounds, culture, national origin, race, color, gender, gender identification, sexual orientation, family status, age, veteran status, disability, religion, or other basis protected by applicable laws. If you need assistance and/or a reasonable accommodation due to a disability during the application or recruiting process, please submit a ticket at Ask HR. Our proactive approach fosters collaboration, innovation, and personal growth, enriching OpenText's vibrant workplace. Compensation: At OpenText, we offer a thoughtfully designed benefits package that supports your physical, emotional, and financial wellbeing. As you move through the hiring process, we’re happy to provide more details about our compensation programs, including variable and commission compensation opportunities for eligible roles, vacation entitlement, and paid time off. Salary Range: $110,960.00 - $160,960.00; Depending on the candidate’s education, experience, skills, geographical location, and alignment with internal equity and external market, actual salary may vary and be higher or lower than the range posted. AI Usage Disclosure: As part of our commitment to transparency, we use artificial intelligence (AI) tools to assist in various stages of our recruitment process, including resume screening, candidate matching, interview scheduling, and communications. These tools are designed to improve efficiency, reduce bias, and enhance candidate experience. All decisions regarding hiring are made by qualified human professionals, and we continuously monitor our AI systems to ensure fairness and compliance with applicable regulations.

What you’ll do

Requirements

Candidates must have 5+ years of experience in cybersecurity or automation engineering and possess strong hands-on skills with Python, Jinja, and REST APIs. Eligibility to obtain and maintain a Government of Canada Secret security clearance is a mandatory requirement.