Senior Security Analyst

Rates.ca; Toronto; Hybrid; CAD 90,000 - 130,000; Full time

Benefits offered by this job

Birthday off

Two in-office days per week

Work from Anywhere program

Full employer-paid benefits

RRSP Matching Program

Annual holidays and free lunches

Job summary

Rates.ca is building out a Security Engineering function and seeks an analyst to own hands-on security operations, data protection, vulnerability management, and compliance evidence. The role collaborates with engineers on remediation, defines controls, and contributes to PCI DSS, SOC 2, and NIST CSF evidence programs.

The analyst will monitor alerts across Microsoft Defender XDR, Purview, Cloudflare, and AWS/Azure, tune detections, and produce weekly security metrics.

Qualifications

• 5+ years in security analyst/ops/engineering
• Hands-on cloud platform experience (AWS or Azure) and Microsoft 365 security tooling
• Experience in two of: SIEM/XDR, vulnerability management, DLP, incident response, CSPM
• Familiarity with PCI DSS, SOC 2, NIST CSF, ISO/IEC 27001 or equivalent
• Scripting ability to automate work: PowerShell, Python, or KQL
• Ability to write clearly for engineers and executives
• Comfort with ambiguity and building new processes

Responsibilities

• Monitor and triage alerts across Defender XDR, Entra ID, Purview and Cloudflare to documented outcomes
• Tune detections to reduce false positives and document reasoning
• Create detection content including Sigma rules from real findings
• Support centralised logging and retention with Sentinels/data connectors
• Produce the weekly security operations metrics pack
• Operate Purview data classification and DLP rollout; tune sensitive information types
• Review DLP matches and triage incidents
• Measure false positives and drive improvement
• Run recurring vulnerability scans and cloud posture reviews
• Prioritise findings by exploitability and business impact
• Collaborate with engineering on remediation/testing criteria
• Track findings to closure against SLAs
• Maintain attack surface inventory
• Collect and maintain PCI DSS/SOC 2/NIST CSF evidence
• Support SOC 2 readiness with control narratives and evidence sampling
• Maintain control mapping and update as estate changes
• Assist audits and third-party risk assessments
• Act as first responder for incidents and maintain chain of custody
• Follow incident response playbooks and post-incident reviews
• Join on-call rotations and post-incident reviews
• Ensure incidents yield durable improvements (detections or controls)
• Know guardrails around AI usage and monitor AI implementations
• Ensure AI outputs are reviewable/auditable/defensible
• Own weekly metrics pack and initial DLP tuning
• Close vulnerability findings with engineering squads

Skills

SIEM/XDR operations

AWS/Azure experience

Data loss prevention

PCI DSS/SOC 2/NIST CSF

Scripting: PowerShell/Python/KQL

Tools

Microsoft Purview

Microsoft Sentinel

Cloudflare

Job description

Rates.ca operates high-traffic, regulated financial and insurance platforms where security, data protection and operational resilience are core business requirements. We are building out the Security Engineering function, and this is the first dedicated analyst role on that team. It is a hands‑on role for someone who wants to operate controls rather than only document them. You will work directly with the Senior Manager, Security Engineering on a programme that is already defined and funded: data classification and data loss prevention, centralised logging and retention, vulnerability and exposure management, third‑party risk, and PCI DSS and SOC 2 evidence. The programme is early enough that your work will shape it, which means unusual visibility and ownership for an analyst role.

What you will do ...

Security operations and monitoring

• Monitor and triage alerts across Microsoft Defender XDR, Entra ID Protection, Microsoft Purview and Cloudflare, and drive each one to a documented outcome.
• Tune detections to reduce false positives, and record the reasoning behind every tuning decision.
• Build and maintain detection content, including Sigma rules derived from real findings and incidents.
• Support the build‑out of centralised logging and retention, including Microsoft Sentinel data connectors, Cloudflare Logpush and Azure diagnostic settings.
• Produce the weekly security operations metrics pack for Security Engineering.

Data protection and classification

• Operate the Microsoft Purview data classification and DLP programme through its phased rollout: simulation, then policy tips, then enforcement.
• Tune sensitive information types and build custom classifiers for Rates.ca quote, policy and claim reference formats.
• Review DLP matches, triage incidents, and run the exception process with named category owners.
• Measure and report the false positive rate, and drive it down.

Vulnerability and exposure management

• Run recurring vulnerability scanning and cloud posture review across AWS, Azure, Microsoft 365 and the Cloudflare edge.
• Prioritise findings by real exploitability and business impact rather than raw CVSS score.
• Work directly with engineering squads on remediation, with acceptance criteria they can test against.
• Track findings to closure against agreed SLAs, and escal
• Maintain the attack surface inventory across production zones and cloud accounts.

Compliance and audit evidence

• Collect, structure and maintain evidence for PCI DSS v4.0.1, SOC 2 and NIST CSF 2.0.
• Support SOC 2 readiness: control narratives, evidence sampling, and auditor walkthroughs.
• Maintain the control mapping and keep it current as the estate changes.
• Support internal and external audits, and track remediation of findings to closure.
• Support third‑party risk assessments, including obtaining and reviewing attestations of compliance from service providers.
• Act as a first responder for security incidents: triage, contain, preserve evidence, escal.
• Follow and improve incident response playbooks, and maintain chain of custody for evidence.
• Participate in the on‑call rotation and in post‑incident reviews.
• Make sure every incident produces at least one durable improvement, usually a detection or a control.

AI‑augmented security

Security Engineering at Rates.ca is AI‑enabled by design. You will be expected to know how to place guardrails around AI usage and how to monitor it. That means acceptable‑use boundaries, controlling what data can reach AI services, detecting shadow AI, and telemetry showing who is using which AI tools and with what data. Every AI‑assisted output must be reviewable by a human, auditable and traceable, and defensible to an auditor, a regulator or an insurer. AI accelerates the analysis. You remain accountable for the decision.

What you need to succeed ...

Required

• 5 or more years in a security analyst, security operations or security engineering role. We will consider strong candidates at 4 years who can show real depth.
• Hands‑on production experience with a major cloud platform, AWS or Azure, and with Microsoft 365 security tooling.
• Practical experience in at least two of: SIEM or XDR operations, vulnerability management, data loss prevention, incident response, cloud security posture management.
• Working knowledge of a security framework as it is actually operated, not only as it is written: PCI DSS, SOC 2, NIST CSF, ISO/IEC 27001 or equivalent.
• Scripting ability sufficient to automate repetitive work: PowerShell, Python, KQL or similar.
• The ability to write clearly for two audiences: an engineer who needs to fix something, and an executive who needs to decide something.
• Comfort with ambiguity, and with building a process where none exists yet.

Nice to have

• Microsoft Purview: Information Protection, DLP or Insider Risk Management.
• Microsoft Sentinel or another SIEM at an engineering level, including detection authoring.
• Experience in a regulated environment such as financial services, insurance or payments.
• Exposure to PCI DSS or SOC 2 Type II evidence collection and audit support.
• Familiarity with CI/CD security, including container, dependency and secrets scanning.
• Certifications such as Security+, SC-200, AZ-500, AWS Security Specialty, PNPT, GCIH, GCIA or CISSP. We care more about what you have operated than what you have passed.

How success is measured ...

In your first 90 days you will own the weekly metrics pack, take the data loss prevention program through its first tuning cycle, and close your first set of vulnerability findings with an engineering squad. You will also be implementing and enforcing policies from the cybersecurity program, and assisting with vendor tools onboarding. The trend‑based measures this role contributes to:

• Critical and high severity vulnerability exposure, open versus SLA.
• Percentage of security issues detected before production.
• Mean time to triage and mean time to contain.
• Data loss prevention false positive rate, trending down.
• Audit findings, count and severity.
• Third‑party risk assessment coverage and residual risk trend.

We are a team of curious minds who love to learn, build and grow together. We value transparency, ownership and continuous improvement. You will have the freedom to innovate and the support to thrive.

• You get your Birthday off.
• This role requires two in‑office days per week (Tuesday and Thursday), with an additional Wednesday in the office every other week.
• 4 weeks of Work from Anywhere Program every year.
• Full employer‑paid benefits.
• RRSP Matching Program with Wealthsimple.
• Annual holiday festivities, free lunches and so much more.
• Helping you help others with our paid volunteer programs.
• Employee satisfaction survey for you to voice your opinion on working at Rates.ca Group Ltd.
• Free access to LinkedIn Learning.
• Lounge and games room: ping‑pong, pool, foosball and more.
• The compensation package consists of a competitive salary, benefits and an incentive bonus.

Rates.ca Group Ltd. and its subsidiaries are committed to being an Equal Opportunity Employer. We provide equal opportunity to all qualified individuals regardless of race, color, religion, age, gender, gender expression, national origin, veteran status, disability or any other legally protected categories such as sexual orientation. We believe that diversity, equity and inclusion are critical to our mission, creating a foundation for a creative workplace that leads to innovation and growth. We value diversity and strive to create an inclusive, accessible workplace where all individuals feel valued, respected, and heard.

We are committed to working with and providing accommodations to candidates and employees with physical or mental disabilities. If you require accommodation in order to search for a job opening or to complete any part of the application or hiring process, please send an email to [e-mail].