Security Analyst, SOC (Tier 2)

Insight Global; Toronto; On-site; CAD 90,000 - 120,000; Full time

Job summary

Insight Global seeks a hands-on Cyber Security Analyst to join a growing security team. The role focuses on day-to-day security operations, incident response, MDR provider management, and maturing the security program.

The successful candidate will have a strong SOC/IR background and hands-on experience with the Microsoft security ecosystem, including Defender, Azure, Sentinel, Entra ID and Intune. This person should own security incidents and help move the security practice toward a more mature

Qualifications

• 2–3+ years hands-on cybersecurity in SOC/IR.
• Experience investigating and responding to security incidents.
• Experience with outsourced MDR or MSSP and alerts/escalations.
• Strong knowledge of Microsoft Defender, Sentinel, Entra ID, and Intune.
• Understanding of SIEM concepts and monitoring.
• Familiarity with KQL or similar security query languages.
• Experience across endpoint, network, cloud and application security events.
• App security/DevSecOps concepts and monitoring.

Responsibilities

• Own and manage Tier 2 security incident queue from triage to closure.
• Handle day-to-day security tickets/incidents and improve SOC processes.
• Escalate alerts from MDR provider and internal service desk.
• Determine incident validity and business impact; coordinate containment.
• Maintain incident docs, runbooks and metrics; close gaps in monitoring.

Skills

SOC experience

Incident response

MDR/MSSP

Threat hunting

Security monitoring

Ownership & accountability

Communication skills

Security investigations

Tools

Microsoft Defender

Microsoft Sentinel

Azure

Entra ID

Intune

Purview

KQL

GitHub security tooling

Job description

Job Description

Insight Global is looking for a hands‑on Cyber Security Analyst to join a growing security team. This individual will play a key role in day‑to‑day security operations, incident response, MDR provider management, and the continued maturation of the organization's security program.

The successful candidate will have a strong SOC / incident response background and hands‑on experience within the Microsoft security ecosystem, including Defender, Azure, Sentinel, Entra ID, and Intune. This person should be comfortable taking ownership of security incidents, working with an outsourced MDR provider, identifying gaps in monitoring and tooling, and helping move the security practice toward a more mature future state.

This is not a governance‑focused role. The ideal candidate is technically curious, accountable, and capable of looking beyond individual tickets to identify opportunities to improve the overall security environment.

Key Responsibilities

Incident Response & Security Operations

• Own and manage the Tier 2 security incident queue, including triage, prioritization, investigation, containment, and closure.
• Manage approximately 5–7 day‑to‑day security tickets/incidents, while using additional capacity to improve SOC processes and security capabilities.
• Act as an escalation point for alerts generated by the MDR provider and internal service desk.
• Determine the validity and business impact of security incidents and escalated critical issues appropriately.
• Coordinate containment activities with IT and infrastructure teams, including account disabling, endpoint isolation and blocking.
• Maintain clear incident documentation, response playbooks and operational metrics.
• Identify gaps in monitoring, alerting and incident‑response processes and recommend improvements.

MDR / MSSP Management

• Act as the day‑to‑day technical contact for the organization's Managed Detection and Response (MDR) provider.
• Review and challenge MDR escalations to ensure alerts are actionable and meet agreed‑upon SLAs.
• Track MDR recommendations and incidents through resolution.
• Validate monitoring and tooling coverage across endpoints, network, cloud and applications.
• Help measure MDR performance and identify opportunities to mature the relationship and security practice.

Microsoft Security & Cloud

• Work hands‑on across the Microsoft security ecosystem, including:
• Microsoft Defender XDR
• Microsoft Sentinel
• Microsoft Entra ID
• Microsoft Intune
• Microsoft Purview / DLP Azure security tooling
• Perform security investigations, alert analysis and threat hunting.
• Review risky sign‑ins, device compliance, endpoint activity and cloud security events.
• Support Sentinel capabilities including data connectors, analytics rules, workbooks and KQL‑based investigations.
• Assist with the organization's continued consolidation and maturation of its Microsoft security environment.

Application Security & DevSecOps

• Partner with infrastructure and application‑development teams to ensure sufficient security monitoring exists across both infrastructure and application layers.
• Understand differences in security monitoring requirements across technologies such as Linux, .NET and WordPress applications.
• Review security requirements for Azure‑hosted workloads and web applications.
• Support secure software‑development practices such as code scanning, dependency scanning, secrets management and application logging.
• Help identify gaps in application‑layer monitoring and recommend appropriate controls and alerts.
• Contribute to incident‑response playbooks for threats including phishing, compromised accounts, ransomware precursors and web application attacks.

We will use AI to search and screen candidates.

Skills and Requirements

• 2–3+ years of hands‑on cybersecurity experience, ideally within a SOC, enterprise security operations or incident‑response environment.
• Demonstrated experience investigating and responding to security incidents from initial alert through resolution.
• Experience working with an outsourced MDR or MSSP and handling security alerts/escalations.
• Strong foundational knowledge of the Microsoft security stack, particularly: Microsoft Defender Microsoft Sentinel Azure Entra ID Intune.
• Understanding of SIEM technologies and security monitoring concepts.
• Familiarity with KQL or similar security‑query languages.
• Understanding of endpoint, network, cloud and application security events.
• Exposure to application security and/or DevSecOps concepts, particularly security logging and monitoring.
• Ability to identify gaps in security tooling, monitoring or processes and recommend improvements.
• Strong ownership and accountability with the ability to operate independently.
• Strong written and verbal communication skills with the ability to communicate incidents to both technical and non‑technical stakeholders.
• Microsoft SC-200 (Security Operations Analyst)
• Nice to Have
• Experience working with Arctic Wolf or another MDR platform.
• Experience with Microsoft Sentinel configuration, connectors or analytics rules.
• Microsoft Purview / Data Loss Prevention experience.
• Application security experience with WordPress, .NET and/or Linux environments.
• Azure application and infrastructure security experience.
• Exposure to GitHub or Azure DevOps security tooling, including code scanning, dependency scanning and secrets management.
• Experience within manufacturing, distribution, logistics or another 24‑hour operational environment.
• Certifications

Certifications

Additional certifications considered an asset:

Microsoft AZ-500Microsoft SC-100CompTIA Security+ or CySAGIAC GCIH / GCIA

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to [e-mail].