Senior Cyber Security Specialist - Cyber Incident Management

Sobeys; Calgary; On-site; CAD 110,000 - 150,000; Full time

Benefits offered by this job

Health benefits

Dental benefits

Employee Share Ownership Plan

10% store discount

Virtual healthcare

Employee Assistance Program

Development opportunities

Parental leave top-up

Paid vacation

Job summary

Sobeys Inc. in Calgary, AB, is seeking a Senior Cyber Security Specialist – Cyber Incident Management to lead critical security operations and incident response.

This role combines hands-on investigations with strategic guidance to advance DFIR capabilities across the organization. You will mentor incident responders, refine playbooks and SOPs, coordinate with an MSSP, and report monthly on security metrics to senior leadership.

Qualifications

• Bachelor's degree in computer science or information security or related field.
• 5+ years in cybersecurity operations with incident response leadership.
• Experience leading complex security investigations across multiple domains.
• Strong understanding of TCP/IP, Windows/Linux, and defensive strategies.
• Proficiency with SIEM, EDR, IDS/IPS, and firewalls.
• Excellent written and verbal communication under pressure.

Responsibilities

• Act as a Senior SME for Cyber Incident Management, handling alert triage, investigation, and containment.
• Mentor and guide incident responders in complex investigations and decisions.
• Conduct thorough investigations using SIEM, EDR, IDS/IPS, and other tools to identify IOCs.
• Tune security use cases to improve detection and reduce false positives.
• Lead incident response during major events and coordinate lifecycle activities.
• Develop and mature DFIR capabilities, playbooks, and SOPs.
• Document investigations, remediation steps, and lessons learned.
• Define and report key KPIs monthly to improve operations.

Skills

Cyber Incident Management

SecOps leadership

Threat detection & response

Security investigations

Analytical thinking

Communication skills

Education

Bachelor's degree in Computer Science or Information Security

Tools

SIEM

EDR

IDS/IPS

Firewalls

Email Security Gateways

Proxies

Job description

Embark on a rewarding career with Sobeys Inc., celebrated among Canada’s Top 100 employers where your unique contributions drive success.

The Senior Cyber Security Specialist, Cyber Incident Management will be a highly experienced and technically adept cybersecurity professional who will lead critical aspects of our security operations and incident response functions. This role demands a proactive individual capable of hands‑on investigation and response, while also providing expert guidance, driving the maturity of our DFIR capabilities, and leading the charge during major incidents. You’ll leverage a comprehensive suite of security tools, collaborate extensively with internal and external stakeholders, and be instrumental in continuously enhancing our defensive posture. This position requires an exceptional analytical mind, advanced problem‑solving skills, and the proven ability to maintain composure and make sound decisions under significant pressure.

Sobeys is full of exciting opportunities, and we are always looking for bright new talent to join our team! We currently have a full‑time opportunity for a Senior Cyber Security Specialist – Cyber Incident Management. This role can be based out of one of our main offices including: Stellarton, NS; Mississauga, ON; Calgary, AB; Burnaby, BC.

Key Responsibilities

• Act as a Senior SME for the Cyber Incident Management team, contributing to day‑to‑day security operations activities, including alert triage, investigation, and incident containment.
• Provide expert guidance and mentorship to Cyber Incident Management Specialists, assisting them with complex investigations, troubleshooting, and decision‑making.
• Conduct efficient and thorough investigations of security alerts, events, and incidents using a variety of security tools (e.g., SIEM, Firewall, WAF, EDR, IDS/IPS, Email Security Gateways), analyzing security logs, network traffic, and endpoint data to identify indicators of compromise (IOCs) and determine scope and impact.
• Drive the continuous fine‑tuning and optimization of security use cases within the security solutions to enhance detection efficacy, reduce false positives, and minimize alert fatigue.
• Take charge and lead incident response efforts during major security incidents, coordinating activities, defining strategies, and guiding the team through the entire incident lifecycle.
• Play a key role in establishing and maturing comprehensive DFIR capabilities, including developing advanced investigation methodologies, tools, and processes.
• Develop and refine incident response playbooks, Standard Operating Procedures (SOPs), and other critical operational documentation, ensuring they are current and effective.
• Proactively develop and maintain comprehensive documentation for incident response activities, investigation findings, remediation steps, and lessons learned.
• Define, track, and report on key metrics monthly to measure the effectiveness of security operations and incident response, identifying areas for improvement.
• Prepare detailed and clear incident reports for various stakeholders, including technical teams and senior management.
• Build a strong partnership with our Managed Security Service Provider (MSSP) for efficient alert escalation and collaboration by working hand‑in‑hand with them.
• Provide advanced technical support and guidance to other IT & Cyber teams on security best practices, emerging threats, and incident prevention strategies.

Qualifications

Mandatory:

• An undergraduate degree or diploma in computer science, information security, or a related technical discipline.
• 5+ years of progressive industry experience working in Cybersecurity operations, with a significant focus on Incident Response and Security Operations (SecOps) leadership or senior roles.
• Demonstrated expertise in leading and conducting complex security investigations and incident response efforts across various security domains (e.g., network, endpoint, cloud, applications).
• Strong understanding of network and system security concepts, including TCP/IP, operating systems (Windows, Linux), common attack vectors, and defensive strategies.
• Proficiency in using a variety of security tools and technologies, including but not limited to: SIEM, EDR, IDS/IPS, Firewalls, Email security gateways, Proxy, etc.
• Excellent analytical and problem‑solving skills with a methodical approach to complex investigations.
• Strong attention to detail and the ability to work effectively and make sound decisions under pressure during critical incidents.
• Ability to work outside of regular business hours, including nights and weekends, to respond to security incidents.
• Excellent written and verbal communication skills, with the ability to articulate highly technical information clearly and concisely to diverse audiences, including senior management and non‑technical stakeholders.
• Strong interpersonal skills, with a proven ability to build rapport, influence, and collaborate effectively with diverse teams, external partners, and vendors.
• Advanced industry certification(s) such as GCIH, GCFA, ECIH, OSIR, BTL2, or equivalent.

Nice To Have:

• Proven experience working directly in or closely with Managed Security Service Providers (MSSPs) at a senior or lead level. Knowledge and experience working in a complex retail technology environment is highly desired.
• Demonstrated experience in developing and implementing Digital Forensics and Incident Response (DFIR) programs, including handling complex and large‑scale incidents such as Business Email Compromise (BEC), Ransomware, or advanced persistent threats.

Who We Are

Sobeys is one of Canada’s leading grocery retailers, with more than 1,600 stores across all 10 provinces and banners including Sobeys, Safeway, IGA, Foodland, FreshCo, Thrifty Foods, and Lawtons Drug Stores. Our 128,000 teammates and franchise affiliates are passionate about delivering great food and exceptional experiences to our customers and communities.

Learn More About Our Story And Culture

Who We Are | Why Work With Us

Total Rewards

We offer a Total Rewards package designed to support teammates at work and in life. Depending on role and eligibility, teammates may receive health and dental benefits, retirement and savings programs including an Employee Share Ownership Plan, a 10% in‑store discount at participating banners, virtual healthcare and an Employee and Family Assistance Program, learning and development opportunities, parental leave top‑up, and paid vacation.
Sobeys is committed to providing a compensation structure that is flexible, equitable and competitive in the market to enable performance and growth. Individual compensation is determined based on qualifications, experience, and internal equity within the range provided.

Additional Information

External websites may share our organization's job postings which includes compensation information based on similar roles and market benchmarks. These figures are provided for general comparison purposes only and are not issued or verified by our organization.

We may use Artificial Intelligence (AI) tools to support efficiencies in the candidate screening, assessment, and recruitment processes. These AI tools do not make hiring decisions on behalf of the Company. Hiring decisions are made by our Hiring Teams.

Sobeys is committed to creating accessible and inclusive hiring processes. We will work with applicants requesting accommodation at any stage of the recruitment process.

Please note: Successful candidates will be required to provide documentation to prove their legal ability to work in the position during the onboarding process. Documentation will be assessed by the employer prior to commencement of work.