Security Operations Analyst: Incident Response & Threat Hunting

officeally; Vancouver; Presencial; CAD 90.000 - 120.000; Jornada completa

Descripción de la vacante

Office Ally is a cloud-based healthcare technology company focused on revenue cycle management and security. The Security Operations Analyst will serve as the first line of defense, monitoring and triaging alerts across SIEM, EDR, identity, email security, and data protection.

This is a hands-on role with ownership over incidents and runbook development. You will work with security engineering, cloud infrastructure, and IT operations to investigate threats, coordinate responses, and maintain

Responsabilidades

• Monitor security incidents, assess severity, investigate context, and document actions.
• Investigate endpoint alerts, review timelines and file events, initiate live responses.
• Analyze internal alerts for risky OAuth apps, unusual downloads, shadow IT, and policy violations.
• Coordinate investigations by correlating logs, UBA alerts, and remediation of findings.
• Document incidents in tickets for audit evidence and post-incident review.
• Triage phishing, attachments, BEC, and user-reported messages.
• Review email threat findings and coordinate remediation such as recall, blocking senders, and user notification.
• Monitor chat/file sharing for anomalies, external risks, and DLP hits.
• Run KQL hunting queries to identify threats not surfaced by automated rules.
• Analyze logs across sign-ins, device events, email transport, and cloud activity.
• Investigate identity logs for login anomalies, lateral movement indicators, Kerberos abuse, and unusual auth patterns.
• Identify false positives and help tune suppression for high-volume alerts.
• Review sign-in logs and CA results for compromised accounts, token abuse, MFA gaps, auth anomalies.
• Support identity incidents including AD lockouts, account compromise response, and offboarding.
• Verify Intune device compliance; flag unmanaged/non-compliant devices.
• Identify stale sessions, unrevoked tokens, and privilege inconsistencies.
• Respond to DLP incidents across mail/file shares and coordinate with data owners.
• Support compliance activities including control evidence collection and audits.

Descripción del empleo

Office Ally is a cloud-based healthcare technology company focused on revenue cycle management and security. The Security Operations Analyst will serve as the first line of defense, monitoring and triaging alerts across SIEM, EDR, identity, email security, and data protection.

This is a hands-on role with ownership over incidents and runbook development. You will work with security engineering, cloud infrastructure, and IT operations to investigate threats, coordinate responses, and maintain