Job TitleCybersecurity Analyst – Tier 2
Job DescriptionTheSecurity Operations Center Tier 2 Analystwill lead complex investigations, coordinate incident response efforts, and drive continuous improvement in threat detection and response capabilities. You will serve as a technical expert and escalation pointforTier 1analysts,customersor otherdepartments.This role supports incident detection, escalation, and responseactivities withincustomer environments, in line with agreed SOC service scope and service level agreements (SLAs).Youwill have hadpreviousexperience in handling escalation from Tier 1 and direct work in security monitoring, threat intelligence, or incident response
Key Responsibilities
- Perform advanced analysis of escalated security incidents and support investigation efforts.
- Act as an escalation point for Tier 1 analysts andprovideexpert guidance during incident response activities.
- Develop and tune detection rules and use cases in SIEM and other platforms.
- Perform threat hunting based on intelligence and behavioral analysis.
- Conduct forensic analysis and reverse engineering of malware when needed.
- Collaborate with threat intelligence teams to enrich investigations.
- Provide strategic recommendations to improve SOC processes and technologies.
- Mentor junior analysts and contribute to training programs.
- Participate in detection validation and lessonslearned activities to enhance SOC detection and response.
Additional Responsibilities
Monitoring & Detection
- ValidatecomplexalertsescalatedbyTier 1
- Determinescope, impact, and severity of confirmed incidents.
- Perform deep log analysis, forensic investigations, and develop custom detection rules.
- Implement containment,mitigationand remediationactions.in accordance with playbooks and customer agreements
- Understanding TTPs (tactics, techniques, procedures) of threat actors
- Ability to develop custom detection rulesand correlation logic
Investigation & Analysis
- Analyze data patterns and outliers toidentifythreat actor behaviors and insider threats.
- Conduct deep investigations into logs, network telemetry, and endpoint activity.
- Document findings, actions taken, and recommended next steps.
Incident Response Support
- Assist the SOC team during active security incidents by collecting evidence andcontaininglowseverity threats as per playbooks.
- Follow established runbooks to ensure consistent and compliant response actions.
- Respond to escalated security incidents requiring advanced analysis.
- Provide containment recommendations and support remediation.
Access Management
- Processing user access requests (add, remove,modify) following established workflows.
- Enforcing leastprivilege principles and rolebased access standards.
- Conducting periodic access reviews (user accounts, permissions, group memberships).
- Investigating and escalating suspicious access activities or unauthorized access attempts.
Patch Management
- Assistwith tracking and verifying system patch status as part of vulnerability review activities.
- Monitor patchrelated alerts (failed deployments, outdated versions) within security tools and coordinate remediation with IT operations.
- Support the vulnerability management process byvalidatingmissing patchesidentifiedduring scans and escalating highrisk findings.
(This is aligned with Tier 1s documented tasks involving vulnerability scans and reporting.)
Reporting & Communication
- Generate clear,accurateincident reports and daily shift summaries.
- Communicate event details with internal teams in a professional andtimelymanner.
Continuous Improvement
- Recommend improvements to detection rules, response processes, and SOC procedures.
- Stay current on cyber threat trends, attacker techniques (TTPs), and security best practices.
Required Qualifications
- 5+ years of experience in cybersecurity, with at least 2 years in a SOC or IR role.
- Advancedexpertisein SIEM, EDR, and forensic tools.
- Strong understanding of MITRE ATT&CK framework and threat actor TTPs.
- Experience with scripting and automation (e.g., Python, PowerShell).
- Ability to lead and manage incident response efforts under pressure.
- Relevantsecurity certifications from ISC2 or ISACA
- Excellent communication and leadership skills.
Preferred Qualifications
- Bachelors degree in IT, Cybersecurity, or CS
- GIAC certifications (GSEC, GCIH, GMON)
- EDR, IDS/IPS, and network security tools
- SIEM/SOAR workflows/playbooks
- Threat intelligence platforms
Key Competencies
- Strong analytical and problemsolving skills
- Ability to work under pressure during incidents
- Teamfirst mindset and willingness to learn
- Ability to recognize patterns and anomalies
- Prior SOC or IR experience
- Strong analysis and investigation skills
- Familiarity with threat intelligence and adversary behavior
- Ability to perform forensic/log analysis
- More advanced certifications preferred
Work Environment
- 24/7 SOC environment - day shift with weekend coverage
- Fastpaced operational setting with tight response timelines
- Collaboration with crossfunctional IT and security teams
Salary range:
This is a full-time, exempt position, eligible to receive a base salary and to participate in an annual performance bonus program. The salary range listed represents the maximum and minimum starting base pay for this position as of the time of posting. Final salary offered will be determined based on factors including but not limited to the candidates skills and experience. The annual performance bonus program is preset and not candidate dependent.
Salary range for this position is CAD$90,000 to CAD$115,000.
