IT Secuity analyst

Maarut Inc; Montreal (administrative region); On-site; CAD 85,000 - 110,000; Full time

Job summary

Maarut Inc. is seeking an IT security analyst for its SOC at level 2, focusing on investigation of escalated alerts and threat handling.

You will qualify phishing, account compromise, malware or lateral movement cases, and coordinate with other teams to implement initial containment measures. As the technical escalation point for Level 1 SOC analysts, you will document investigations, determine verdict, severity and impact, and contribute to improving detection rules and runbooks.

Responsibilities

• Investigate escalated alerts in phishing, account compromise, malware or lateral movement cases
• Correlate events across SIEM, XDR, EDR, identity, email, network and cloud platforms
• Enrich alerts with logs, indicators of compromise and threat intelligence
• Determine verdict, severity and potential impact of incidents
• Recommend or initiate first mitigation, containment or escalation actions per processes
• Document investigations, findings, decisions and actions
• Provide first-level technical analysis of endpoint and network logs and artefacts
• Support and coach Level 1 SOC analysts on complex cases
• Improve detection rules, investigation queries, runbooks and playbooks
• Utilize approved AI and automation tools for triage, enrichment and documentation

Job description

• The client is looking for an IT security analyst for its SOC, positioned at level 2: alerts reach this person already escalated by level 1, and the person in turn acts as the technical escalation point for those analysts.
• The work centres on investigation: qualifying phishing, account compromise, malware or lateral movement cases, correlating events across several platforms, then enriching them with logs, indicators of compromise and threat intelligence.
• The person determines verdict, severity and impact, then recommends or initiates first measures according to established processes, with incident response remaining initial and carried out with other teams.
• The form title specifies no level, while the full set of responsibilities describes a level 2 role.
• The Talents and qualifications section is empty: no degree, certification, language or named tool is required, so assessment rests entirely on the activity profile.
• Target candidate: a QA professional with at least 10 years in IT, including 5 years in testing, who has coordinated testing within agile teams and uses JIRA, XRAY, Cypress and Playwright in recent mandates.
• Group insurance exposure or an integration project will set apart otherwise equal candidates.

Requirements

Required:

• Analysis and qualification of escalated alerts (phishing, account compromise, malware, lateral movement)
• Event correlation (SIEM, XDR, EDR, identity, email, network, cloud)
• Alert enrichment (logs, indicators of compromise, threat intelligence)
• Determination of verdict, severity, potential impact and required actions
• Initial mitigation, containment or escalation measures, recommended or initiated per processes
• Documentation of investigations, findings, decisions and actions
• First-level technical analysis of endpoint and network logs and artefacts
• Support and coaching of level 1 SOC analysts on complex cases
• Improvement of detection rules, investigation queries, runbooks and playbooks
• Use of approved AI and automation tools (triage, enrichment, documentation)