Cybersecurity Analyst

Spait Infotech; Toronto; On-site; CAD 60,000 - 90,000; Full time

Job summary

Spait Infotech in Toronto is seeking a Security Operations Specialist to monitor security alerts, investigate incidents, and perform triage across networks, endpoints, and cloud environments. The role emphasizes SIEM expertise, threat hunting, and collaboration with IT teams to contain and remediate threats.

The ideal candidate SaaS/enterprise security experience, strong analytical skills, and knowledge of MITRE ATT&CK.

Qualifications

• Strong understanding of networking fundamentals.
• Experience with Windows and Linux security.
• Hands-on experience with SIEM tools.
• Understanding of EDR/XDR, endpoint security, and vulnerability management.
• Knowledge of incident response and common attack techniques.
• Familiarity with MITRE ATT&CK, IOC analysis, and threat intelligence.
• Basic scripting in Python, PowerShell, or Bash.
• Understanding of authentication concepts: Active Directory, Azure AD/Entra ID, MFA, IAM.
• Strong analytical, troubleshooting, documentation, and communication skills.

Responsibilities

• Monitor security alerts and events using SIEM platforms and respond per procedures.
• Investigate security incidents, phishing, malware, and unauthorized access.
• Conduct incident triage, analysis, containment, and escalation.
• Analyze logs from networks, endpoints, servers, apps, and cloud.
• Assist with remediation of identified weaknesses and leakage of data.
• Support EDR/XDR solutions and threat hunting.
• Perform investigations using network traffic, logs, and threat intel.
• Contribute to post-incident root-cause analysis.
• Maintain and improve monitoring rules, alerts, dashboards, and documentation.

Skills

Networking fundamentals

Windows security

Linux security

SIEM

EDR/XDR

Incident response

MITRE ATT&CK

IOC analysis

Threat intelligence

Python

PowerShell

Bash

Active Directory

Azure AD/Entra ID

MFA

IAM

Analytical skills

Troubleshooting

Documentation

Communication

Job description

• Monitor security alerts and events using SIEM platforms such as Microsoft Sentinel, Splunk, or QRadar.
• Investigate security incidents, suspicious activities, phishing attempts, malware alerts, and unauthorized access.
• Perform incident triage, analysis, containment, and escalation according to established procedures.
• Analyze logs from firewalls, endpoints, servers, applications, and cloud environments.
• Conduct vulnerability assessments and assist with remediation of identified security weaknesses.
• Support endpoint security and EDR/XDR solutions such as Microsoft Defender, CrowdStrike, or SentinelOne.
• Perform threat hunting and identify indicators of compromise (IOCs).
• Assist with security investigations using network traffic, system logs, and threat intelligence.
• Participate in security incident response and post-incident root-cause analysis.
• Maintain and improve security monitoring rules, alerts, dashboards, and documentation.

Required Skills

• Strong understanding of networking fundamentals: TCP/IP, DNS, HTTP/HTTPS, VPN, firewalls, and common network protocols.
• Knowledge of Windows and Linux security.
• Hands-on experience with SIEM tools.
• Understanding of EDR/XDR, endpoint security, and vulnerability management.
• Knowledge of incident response and common attack techniques.
• Familiarity with MITRE ATT&CK, IOC analysis, and threat intelligence.
• Basic scripting skills in Python, PowerShell, or Bash.
• Understanding of authentication concepts such as Active Directory, Azure AD/Entra ID, MFA, and IAM.
• Strong analytical, troubleshooting, documentation, and communication skills.