Security Operations Center Analyst

OnX; Calgary; Hybrid; CAD 70,000 - 80,000; Part time

Job summary

OnX is seeking a Night shift SOC Analyst for an approximate two‑month contract to monitor incidents, perform triage, investigations, and escalations for Sev 1/2 incidents within a not-for-profit environment serving Alberta’s education, research, and government sectors.

You will work remotely within Canada (Calgary preferred), overseeing incident response, knowledge-base maintenance, and collaboration with member institutions, while adhering to SLAs and security best practices.

Qualifications

• Cybersecurity diploma or equivalent technical training.
• 5–6 years of SOC analyst experience in a demanding environment.
• Certifications such as CompTIA Security+, CySA+, or similar are preferred.
• Hands-on experience through academic projects, Capture the Flag (CTF) competitions, or practical labs (e.g., HackTheBox, LetsDefend) is highly desirable.
• Familiarity with following documented cybersecurity processes, and a willingness to learn incident response workflows.
• Experience working night shifts or independently is an asset.

Responsibilities

• Conduct proactive monitoring, investigation, and escalation of security incidents.
• Identify suspected intrusion attempts and compromises by analyzing event details and summary information.
• Investigate malicious URLs, domains, and IPs using open-source and sector intelligence.
• Provide mitigation guidance in response to identified threats, based on industry practices and vendor recommendations.
• Develop and refine investigative methods for anomalous or suspicious events, in collaboration with rSOC team members.
• Contribute to and maintain the knowledge base for rSOC processes and procedures.
• Use playbooks, guidelines, and a range of techniques to investigate incidents.
• Report gaps in log coverage, parsing issues, and high volumes of false positives.
• Act as first point of contact for member-reported security incidents and service requests, in line with established SLAs.
• Apply cybersecurity and privacy principles to meet organizational requirements.

Skills

SOC operations

Incident response

Log analysis

Threat intelligence

SIEM usage

Communication

Education

Cybersecurity diploma

CompTIA Security+ or CySA+ preferred

Tools

SIEM

UEBA

Job description

Our Client is looking for analysts for overnight coverage (10pm-6:30am). They would monitor the client's 3 institution queue, doing initial triage, investigations in our platform and elevate Sev 1 and 2 incidents to our management team.

Contract, approximately 2 months, with potential for extension or Conversion to full time

Schedule: Overnight, 10:00 pm to 6:00 am ABT (Alberta time), including weekends and holidays

Location: Remote within Canada, with preference for Calgary, Alberta residents

This is a pure night shift hence if you are really interested then apply. Overnight, 10:00 pm to 6:00 am ABT (Alberta time)

About the role

Are you passionate about cybersecurity and eager to apply your technical and investigative skills for the public good?

Our client is a not-for-profit agency whose mission is to improve the lives of Albertans through digital technologies. It serves the province’s education, research, and government sectors. To help the higher education sector defend against online harms, Client has established a regional Security Operations Centre (rSOC) to monitor, detect, and respond to cybersecurity threats.

As a SOC Analyst on the night shift, you will respond to real incidents and make a real-world impact. You will work independently overnight, investigating incidents, managing escalations, and working with member institutions throughout the incident lifecycle. This is a contract role of approximately two months, with potential for extension based on business needs and performance

What you’ll do

• Conduct proactive monitoring, investigation, and escalation of security incidents.
• Identify suspected intrusion attempts and compromises by analyzing event details and summary information.
• Investigate malicious URLs, domains, and IPs using open-source and sector intelligence.
• Provide mitigation guidance in response to identified threats, based on industry practices and vendor recommendations.
• Develop and refine investigative methods for anomalous or suspicious events, in collaboration with rSOC team members.
• Contribute to and maintain the knowledge base for rSOC processes and procedures.
• Use playbooks, guidelines, and a range of techniques to investigate incidents.
• Report gaps in log coverage, parsing issues, and high volumes of false positives.
• Act as first point of contact for member-reported security incidents and service requests, in line with established SLAs.
• Apply cybersecurity and privacy principles to meet organizational requirements.

What you bring

Education and experience

• Cybersecurity diploma or equivalent technical training.
• Atleast 5 to 6 years of SOC analyst experience in a demanding environment
• Certifications such as CompTIA Security+, CySA+, or similar are preferred.
• Hands-on experience through academic projects, Capture the Flag (CTF) competitions, or practical labs (e.g., HackTheBox, LetsDefend) is highly desirable.
• Familiarity with following documented cybersecurity processes, and a willingness to learn incident response workflows.
• Experience working night shifts or independently is an asset.

Skills

• Understanding of cybersecurity threats and risks to the academic sector.
• Experience identifying and investigating security incidents.
• Practical understanding of incident response, vulnerability management, and IT service management.
• Experience with SIEM and UEBA technologies, and with following incident response playbooks.
• Understanding of the MITRE ATT&CK framework.
• Experience investigating suspicious sign-ins, phishing, malware, and network logs.
• Understanding of TCP/IP and other network protocols.
• Experience with threat intelligence feeds.
• Strong problem-solving, analytical, documentation, and communication skills, including the ability to explain technical information clearly to diverse audiences.