Security Operations Analyst

F12.net; Surrey; On-site; CAD 70,000 - 100,000; Full time

Job summary

F12.net is seeking a Security Operations Analyst to join our SOC and deliver security services to SMB clients. You will investigate threats, analyze real-time signals, and manage incident response from triage through resolution.

You will perform forensics, audits, and remediation, while mentoring colleagues and contributing to process improvements. A cybersecurity mindset and collaborative, agile approach are essential.

Qualifications

• 3+ years' experience in network topology and security technologies.
• Bachelor's degree in Computer Science, Computer Engineering or Electrical Engineering with IT focus, or equivalent.
• Practical relevant work experience in lieu of degree accepted in cybersecurity.
• Security+ / CySA+ / CEH / PenTest+ are desirable certifications.
• Demonstrated leadership or initiative at school, work or community.

Responsibilities

• Apply investigation tactics and Runbooks to assess security threats.
• Analyze real-time security signals with accuracy and speed using tools.
• Handle investigations, digital forensics, and client communications.
• Investigate incidents and contribute to incident reports and reviews.
• Improve SOC tooling and participate in internal projects.
• Perform audits and follow up on signals with analysts and customers.
• Block malicious traffic and remediate infected hosts.
• Provide input to training content and mentor junior analysts.
• Document incident workflows and maintain chain of custody.

Skills

Network security

Leadership

Growth mindset

Collaboration

Agile/tech savvy

Education

Bachelor's degree in CS/CE/EE or related

Experience in lieu of degree accepted

Cybersecurity certifications desirable

Job description

The Position: The Security Operations (SecOps) Analyst role is one where we look to build a rich and capable team of security professionals to deliver security services to the SMB market. Our security analysts are expected to be involved in highly technical investigations and support the delivery of meaningful, accurate results for both internal and external customers in a dependable and targeted manner. Time management and in-depth knowledge of all internal and many external products and services are imperative to success. The successful candidate will be relied on to identify threats and handle any security incident or customer request in the SOC.

The analyst will apply their skills and knowledge in the day-to‑day management Cyber activities including, but not limited to, performing and presenting security assessments, penetration tests, analyzing security logs and systems data to identify anomalous or irregular events; completing Cyber management processes to respond to, investigate and report on identified security incidents; maintenance of various security tools and technologies such as advanced malware detection, DDoS, IDS/IPS, DLP, Anti-spam as well as other Cyber threat intelligence and vulnerability management capabilities. The ideal candidate has experience not only using a wide range of technologies to respond to Cybersecurity events but diligent upkeep and continuous improvement of Cyber management processes and tools.

Responsibilities:

• Apply investigative tactics, techniques, and procedures (TTPs) using your understanding of the security threats associated with the incoming signals to accurately follow Runbooks.

• Analyze incoming security signals in real time with a balance of accuracy and speed using a variety of proprietary and third-party tools

• Handle in-depth investigations, digital forensics (network, endpoint, log), and customer requests, conveying results to clients by e-mail and phone as needed.

• Investigate security incidents and contribute to incident response reports and after-action reviews.

• Participate in various internal projects and initiatives to increase SOC efficiency and improve SOC tooling.

• Perform audits and secondary review of selected signals, following up with analysts and customers when necessary.

• Block malicious network traffic, isolate infected hosts on customers’ networks, and perform other remediation actions using internal and third-party tools.

• Complete intermediate customer support requests, service administration and troubleshooting tasks.

• Support and mentor analysts during investigations or customer inquiries.

• Identify gaps in processes and procedures and elevate them to the appropriate teams.

• Provide input to our Learning and Development team on training content.

• Perform manual triaging of triggered alerts to identify potential security incidents and threats

• Document true positives and initiate incident response as needed

• Lead individual stages of incident response as needed

• Collaborate efficiently with internal and external stakeholders

• Document incident response workflow and maintain chain of custody for collected evidence

• Compile post-incident report and present evidence and documentation to executive and legal teams, and law enforcement agencies as needed

• Support special security and compliance requirements of external parties

• Ensure security operations duties are executed in accordance with security policies, procedures, and third party or compliance obligations

• Ability to independently run threat hunting

• Ability to independently perform security assessments, pen-testing and red-teaming in IT and OT environments

Requirements/Qualifications

• 3+ years' experience of overall network topology; network security; internet, intranet, extranet technologies; and operating systems.

• A bachelor's degree in Computer Science or Computer Engineering, or Electrical Engineering with a focus in Information Technology

• Education: Practical relevant work experience in lieu of university degree in related area (Cybersecurity) accepted

• Information security certifications, such as Security+, CySA+, CEH, PenTest+ are desirable.

• Demonstrated leadership or initiative at school, work and/or community (extracurricular activities)

• Growth mindset, with a passion for learning

• Collaborative with an ability to cultivate relationships and networks

• Agile, technically savvy, with a knack at creating solutions

• Creative thinker with a unique ability for resourcefulness

• Strong analytical and organizational skills, effective written and verbal communication skills, and team oriented.

• Familiarity with information security vulnerabilities and risk management.

• A high level of personal skills is required to make formal, persuasive presentations to groups and to deal effectively with people from all segments of the community.

• (New graduate from bachelor's in computer science or Computer Engineering or Electrical/Electronic Engineering with a focus in Information Technology)