Security Technology Analyst

University of Toronto; Toronto; Hybrid; CAD 85,000 - 108,000; Full time

Job summary

University of Toronto is seeking a Security Technology Analyst to implement, tune, and scale advanced security technologies and AI tools across Temerty Faculty of Medicine. You will monitor security data streams, neutralize threats, and support incident response in collaboration with IT and security teams.

The role requires experience with SIEM, EDR/XDR, vulnerability management, and IAM, plus scripting skills and strong communication for cross-functional work.

Qualifications

• Bachelor’s Degree or equivalent in a relevant field.
• Experience with information security practices, risk assessments, and security controls.
• Proficiency with vulnerability management tools such as Tenable, Qualys, or Rapid7.
• Experience with security monitoring platforms like SIEM/SOAR and EDR/XDR tools.
• Strong analytical, documentation, and communication skills.

Responsibilities

• Configure, tune, and maintain security technologies including SIEM, EDR/XDR, firewalls, and IAM integrations.
• Analyze security events, correlate data, and provide initial assessments and escalation info.
• Operate vulnerability scanning, review results, and help identify owners and affected systems.
• Triage and investigate alerts, gather logs and evidence, assess impact, and escalate as needed.
• Manage account provisioning, access modifications, and deprovisioning through approved workflows.
• Identify opportunities to standardize and automate security operations and reporting.

Skills

Security monitoring

SIEM / SOAR

EDR/XDR platforms

Firewalls

Vulnerability management

Identity and access management

Log analysis

Incident response

Python / PowerShell

Communication skills

Documentation & reporting

Education

Bachelor's Degree in Computer Science, Information Security, Information Technology, Engineering, or equivalent

Tools

Tenable

Qualys

Rapid7

Microsoft Sentinel

Splunk

CrowdStrike

Microsoft Defender

SentinelOne

Palo Alto

Cisco

Job description

About us

Home to over 40 departments and institutes, the University of Toronto's Temerty Faculty of Medicine lies at the heart of the Toronto Academic Health Science Network and is a global leader in ground-breaking research and education, spanning clinical medicine, basic science and the rehabilitation sciences sectors.

Your opportunity

MedIT provides information technology support for the Temerty Faculty of Medicine. Our mission is to partner and collaborate with clients, University, and third parties to determine value based, sustainable technology solutions that enable the Faculty to achieve its academic mission.

As Security Technology Analyst, you will be responsible for implementing, tuning, and scaling advanced security technologies and AI tools to protect Temerty Faculty of Medicine systems, data, teaching, research, and administrative activities. Working closely with the Manager, Information Security, you will monitor multifaceted security data streams, proactively neutralizing threats through coordinated incident response, vulnerability management, and supporting incident response investigation. You will contribute to the secure and reliable operation of security technologies by working with vendor-specific platforms and tools such as firewalls, endpoint detection and response solutions, security information and event management systems, configuration and policy management systems, vulnerability management platforms, AI tools, and identity and access management technologies. You will prepare technical evidence and reporting, automate repeatable workflows, execute approved remediation activities, and collaborating cross-functionally with IT and University security teams to reduce risk and strengthen security operations.

Your responsibilities will include

• Configure, tune, troubleshoot, and maintain security technologies, including but no limited to SIEM/security monitoring tools, endpoint protection and EDR/XDR platforms, firewalls, configuration management systems, vulnerability management tools, identity and access management technologies, log collectors, and related integrations
• Analyze security events and alerts, correlate activity across multiple tools and data sources, and provide initial assessments, trends, recommendations, and escalation information
• Operate and support vulnerability scanning and assessment tools; schedule scans, review results, validate findings, and help identify affected systems and owners
• Perform initial triage and investigation of security alerts and suspected incidents, gather relevant logs, sensitive information, and technical evidence, assess potentialsensitivity of impact, and escalation according to established procedures
• Process account provisioning, access modification, suspension, and deprovisioning requests through approved workflows, ticketing systems, and identity management platforms
• Identify opportunities to standardize, automate, and improve security operations, access management, vulnerability tracking, incident response workflows, and operational reporting

Essential Qualifications

• Bachelor's Degree in a relevant field, preferably Computer Science, Information Security, Information Technology, Engineering, or an equivalent combination of education and experience
• Minimum four years relevant work experience in information security, security operations, SOC analysis, threat analysis, vulnerability management, identity and access management
• Significant exposure to information security practices, information risk assessments, security controls, operational security processes, or control assurance activities
• Experience with one or more vulnerability management tools, such as Tenable, Qualys, or Rapid7
• Experience with security monitoring, SIEM, SOAR, endpoint, firewall, or detection platforms, such as Microsoft Sentinel, Splunk, CrowdStrike, Microsoft Defender, SentinelOne, Palo Alto, Cisco, or similar technologies
• Experience analyzing logs, alerts, endpoint telemetry, network events, authentication events, and system activity to support threat detection, incident triage, and remediation
• Experience supporting incident response investigation, evidence gathering, sensitive or privileged information handling, containment, remediation, recovery, and post-incident improvement activities
• Experience supporting identity lifecycle activities, access provisioning and deprovisioning, role-based access, group management, single sign-on, multi-factor authentication, access reviews, or privileged access controls
• Exposure to network architecture, TCP/IP networking, VPN, VLAN, NAT, DNS, firewall, endpoint, operating system, cloud, and security concepts
• Proficiency in at least one scripting or automation language, such as Python, PowerShell, shell scripting
• Strong interpersonal skills and excellent oral and written communication skills
• Excellent documentation, reporting, presentation, and knowledge-sharing skills
• Strong technical troubleshooting, analytical, investigative, and problem-solving skills
• Strong understanding of security operations, vulnerability management, identity and access management, incident response, and security monitoring concepts
• Ability to interpret technical evidence, identify patterns, assess risk, and recommend practical remediation or escalation actions
• Ability to describe complex technical concepts, security issues, and policy requirements to users, technical staff, managers, and senior stakeholders at varying levels of technical understanding
• Ability to manage competing priorities, respond to urgent issues, and maintain accuracy and attention to detail in a fast-paced operational environment
• Sound judgment, discretion, and professionalism when handling sensitive information, security incidents, access rights, logs, and investigation materials
• Strong collaboration and customer-service orientation, with the ability to work effectively across IT, security, academic, research, administrative, vendor, and University stakeholder groups

Assets (Nonessential)

• Relevant security, cloud, vendor, or identity-focused certifications: Security+, SSCP, GSEC, Microsoft Security Operations Analyst, Azure Security Engineer, vendor-specific firewall/EDR/SIEM certifications, or identity and access management credentials
• Experience in a higher education, research, healthcare, or similarly complex environment
• Familiarity with data visualization, dashboarding, reporting, or metrics tools

To be successful in this role you will be

• Insightful
• Perceptive
• Procedural

Job descriptions are available upon request for internal applicants.

Closing Date: 10/27/2026, 11:59PM ET
Employee Group: USW
Appointment Type: Budget - Continuing
Schedule: Full-Time
Pay Scale Group & Hiring Zone:
USW Pay Band 12 -- $84,564 with an annual step progression to a maximum of $108,145. Pay scale and job class assignment is subject to determination pursuant to the Job Evaluation/Pay Equity Maintenance Protocol.
Job Category: Information Technology (IT)
Divisional HR Office Email: [e-mail]

Lived Experience Statement

Candidates who are members of Indigenous, Black, racialized and 2SLGBTQ+ communities, persons with disabilities, and other equity deserving groups are encouraged to apply, and their lived experience shall be taken into consideration as applicable to the posted position.

Diversity Statement

The University of Toronto embraces Diversity and is building a culture of belonging that increases our capacity to effectively address and serve the interests of our global community. We strongly encourage applications from Indigenous Peoples, Black and racialized persons, women, persons with disabilities, and people of diverse sexual and gender identities. We value applicants who have demonstrated a commitment to equity, diversity and inclusion and recognize that diverse perspectives, experiences, and expertise are essential to strengthening our academic mission.

As part of your application, you will be asked to complete a brief Diversity Survey. This survey is voluntary. Any information directly related to you is confidential and cannot be accessed by search committees or human resources staff. Results will be aggregated for institutional planning purposes. For more information, please see http://uoft.me/UP .

Accessibility Statement

The University strives to be an equitable and inclusive community, and proactively seeks to increase diversity among its community members. Our values regarding equity and diversity are linked with our unwavering commitment to excellence in the pursuit of our academic mission.

The University is committed to the principles of the Accessibility for Ontarians with Disabilities Act (AODA). As such, we strive to make our recruitment, assessment and selection processes as accessible as possible and provide accommodations as required for applicants with disabilities.

If you require any accommodations at any point during the application and hiring process, please contact [e-mail] .