Security Operations Center Analyst

CyberWell; Calgary; On-site; CAD 65,000 - 90,000; Full time

Benefits offered by this job

Life insurance

AD&D insurance

Extended health and dental

Long-term disability

Job summary

CYBERWELL in Calgary, Alberta, is seeking a SOC Analyst – Tier 1 to monitor security alerts, conduct initial investigations, and escalate incidents as needed. You will work with Microsoft Sentinel, Cortex XSOAR, EDR/XDR, and cloud environments, supporting government and regulated clients in a fast‑paced SOC.

This entry‑level role focuses on hands‑on security operations, threat detection, and incident response, with on‑site work and a path to grow under experienced analysts while following

Qualifications

• 1–2 years of experience in cybersecurity operations or related field.
• Foundational understanding of security monitoring and incident investigation.
• Familiarity with SIEM platforms and log analysis is a plus.

Responsibilities

• Monitor, triage, and investigate security alerts across SIEM, SOAR, EDR/XDR, identity, network, and cloud platforms.
• Perform initial investigations using logs, endpoint telemetry, and threat intelligence.
• Identify indicators of compromise and escalate incidents as needed.
• Maintain accurate case documentation and follow incident response playbooks.
• Communicate findings to internal teams and clients when required.

Skills

Analytical thinking

Attention to detail

Communication skills

Tools

Microsoft Sentinel

Cortex XSOAR

EDR/XDR

SIEM

SOAR

Cloud security

Job description

CYBERWELL is the new name behind North America’s most trusted cybersecurity brands – Source44, Seekintoo, Cycura, and Proack Security. Now under one banner, we’re scaling our impact with a fresh vision, a stronger portfolio, and a renewed commitment to helping organizations build lasting resilience in today’s evolving threat landscape. In today’s threat landscape, complexity is the constant. At CYBERWELL, we’re built to help organizations not just keep up but get ahead. CYBERWELL is a cybersecurity company purpose built for scale, change, and the realities of modern enterprise. We deliver integrated solution that span the full cybersecurity lifecycle-from offensive security exposure management to GRC, architecture and engineering, threat intelligence, and 24/7 managed detection and response. We partner with enterprise leaders who are navigating regulatory pressure, evolving risk, and growing infrastructure. Whether it's a healthcare provider safeguarding patient data, a government agency defending critical systems, or a tech or financial firm scaling securely - our team helps unify strategy, reduce complexity, and strengthen cyber resilience. Why it matters: Cybersecurity isn't just a technical issue - it’s a business imperative. From compliance and operational uptime to reputation and trust, we help organizations protect what matters most, stay ahead of threats, and build the foundation for long-term success. We're not just another vendor. We're your cybersecurity partner - relentlessly focused on outcomes, backed by world-class talent, and obsessed with your success.

About the Role

The SOC Analyst – Tier 1 plays an important role within the CYBERWELL Cybersecurity Operations Centre (CYBERSOC), supporting the monitoring, detection, and initial investigation of cybersecurity threats across multiple client environments.

This position is well suited to an early-career cybersecurity professional looking to develop hands‑on experience in security operations, threat detection, and incident response. You will work with technologies including Microsoft Sentinel, Cortex XSOAR, EDR/XDR solutions, network security platforms, and cloud environments while supporting government and highly regulated clients.

As a Tier 1 Analyst, you will be responsible for monitoring security alerts, performing initial investigations, identifying suspicious activity, and escalating potential security incidents in accordance with established procedures. You will collaborate with experienced analysts and technical teams while developing your investigative and incident response capabilities.

This is an on‑site position based in Calgary, Alberta.

Key Responsibilities

• Monitor, triage, and investigate security alerts across SIEM, SOAR, EDR/XDR, identity, network, and cloud security platforms.
• Perform initial security investigations using available logs, endpoint telemetry, threat intelligence, and established investigative procedures.
• Identify suspicious activities, indicators of compromise, and potential security incidents requiring further investigation.
• Validate and prioritize security alerts, determining appropriate escalation paths based on severity, impact, and established procedures.
• Escalate confirmed or suspected security incidents to Tier 2 analysts or designated response teams for advanced investigation and containment.
• Maintain accurate and detailed case documentation, including investigation findings, supporting evidence, and actions taken.
• Follow established incident response playbooks, standard operating procedures, and client‑specific escalation requirements.
• Communicate investigation findings and incident updates clearly to internal teams and clients when required.
• Support effective shift handovers by maintaining awareness of active incidents and outstanding investigations.
• Collaborate with senior analysts to develop investigative techniques, strengthen technical knowledge, and improve operational effectiveness.
• Contribute to continuous improvement initiatives by identifying opportunities to enhance investigation procedures and operational workflows.

Qualifications

• 1–2 years of experience in cybersecurity operations, IT support, network administration, or a related technical field. Relevant education, certifications, or hands‑on technical experience may be considered.
• Foundational understanding of cybersecurity concepts, security monitoring, and incident investigation processes.
• Familiarity with SIEM platforms, security alert analysis, or log investigation is considered an asset.
• Exposure to EDR/XDR platforms, network security tools, or cloud security technologies is preferred.

Working knowledge of:

• TCP/IP networking, DNS, HTTP/HTTPS, and common network protocols.
• Windows and Linux operating systems and basic security fundamentals.
• Common cybersecurity threats, malware, phishing, and indicators of compromise.
• Authentication, access management, and endpoint security concepts.
• Basic incident response processes and security monitoring practices.
• MITRE ATT&CK framework and common attacker techniques.
• Strong analytical and troubleshooting skills with attention to detail.
• Ability to follow established procedures and recognize when issues require escalation.
• Strong written and verbal communication skills, particularly when documenting technical findings.
• Ability to manage multiple priorities in a fast‑paced operational environment.
• Willingness to learn new security technologies and develop investigative capabilities.

Experience in an MSSP or multi‑tenant security operations environment is considered an asset but is not required.

Preferred Certifications

The following certifications, or equivalent knowledge and practical experience, are considered assets:

• CompTIA Security+, Network+, or CySA+
• Microsoft SC-900, AZ-900, or SC-200
• ISC2 Certified in Cybersecurity (CC) or SSCP
• Other relevant entry‑level cybersecurity or networking certifications

Work Requirements

• Ability to work on‑site in Calgary, Alberta.
• Participation in a 24/7/365 coverage model, with primary assignment to night shift following completion of onboarding and training.
• Availability to complete initial training on day or evening shifts as required.
• Must be legally authorized to work in Canada. CYBERWELL does not currently provide immigration sponsorship.
• Must be eligible to obtain and maintain the required Government of Canada personnel security screening.
• Ability to work effectively in a security operations environment while following established procedures and escalation processes.

Pay Range and Compensation Package

The salary offered for this position falls within a specified salary range and will be determined based on a variety of factors, including the candidate's experience, qualifications, skills, and the specific needs of the organization.

Applicable shift premiums are provided for evening and night shifts in accordance with company policy.

CYBERWELL offers a comprehensive benefits package, including:

• Life insurance
• Accidental Death and Dismemberment (AD&D) insurance
• Extended health and dental coverage
• Long‑term disability coverage

At WELL, we believe in fair and equitable compensation, and our goal is to offer a competitive salary that reflects the value and expertise of the selected candidate.

WELL is committed to supporting a diverse, inclusive, and accessible workplace. We welcome and celebrate the diversity of applicants and team members across ability, race, gender identity, sexual orientation, and perspective. We strive to create an inclusive workplace where differences are celebrated and fuel our success – this is the WELL Way!

WELL has been independently certified as a Great Place to Work® by Great Place to Work Institute® Canada, an achievement that reflects the company's strong commitment to creating a workplace culture centered on trust, inclusivity, and employee well‑being, aligning with its "Healthy Place to Work" ESG strategy pillar.

Read more about us: https://stories.well.company/