Remote SOC Analyst II — Advanced Triage & Threat Hunting

Arancia; Mississauga; Hybrid; CAD 91,000 - 126,000; Full time

Benefits offered by this job

Remote work

Shift allowances for evenings/nights

Career progression into L3/Detections

Job summary

Arancia, a Canadian cybersecurity firm based in Mississauga, seeks a Level 2 SOC Analyst. You will own advanced triage and investigations, coordinate containment actions, and work with Detection Engineering and Threat Intelligence to reduce dwell time and false positives.

This remote, full‑time role runs on a 24/7 rotating schedule, with evening threat hunting blocks. It offers a clear progression path into L3, Threat Hunting, or Incident Response.

Qualifications

• 2–5 years in a SOC, IR, or blue team role with end-to-end incidents.
• Strong understanding of endpoint, network, identity and cloud security.
• Proficiency in SIEM/EDR tools and MITRE ATT&CK application.
• KQL required; basic Python or PowerShell for automation.
• Bachelor's degree or equivalent practical experience.

Responsibilities

• Triage and investigate alerts escalated from L1 across endpoints, identity, network and cloud telemetry.
• Coordinate containment actions and document evidence with clear reasoning.
• Conduct hypothesis-driven threat hunting during evening blocks.
• Provide tuning feedback to Detection Engineering and validate new detections.
• Produce incident reports and maintain SLA metrics; support shift handovers.
• Mentor L1 analysts and contribute to knowledge bases.

Skills

SOC experience

MITRE ATT&CK knowledge

KQL proficiency

Python/PowerShell scripting

SIEM & EDR tools

Cloud telemetry

Education

Bachelor's degree in Cybersecurity/IT/CS

Tools

Microsoft Sentinel

Defender for Endpoint

CrowdStrike

Entra ID

Elastic SIEM/OpenSearch

Job description

Arancia, a Canadian cybersecurity firm based in Mississauga, seeks a Level 2 SOC Analyst. You will own advanced triage and investigations, coordinate containment actions, and work with Detection Engineering and Threat Intelligence to reduce dwell time and false positives.

This remote, full‑time role runs on a 24/7 rotating schedule, with evening threat hunting blocks. It offers a clear progression path into L3, Threat Hunting, or Incident Response.