Senior Security Operations Analyst: MS Sentinel & Defender MDR

EY; Calgary; On-site; CAD 76,000 - 126,000; Full time

Job summary

EY is seeking a senior, hands-on security operations analyst to support MDR services across multiple client environments. You will lead incident investigations using Microsoft Sentinel and Defender XDR, conduct threat hunting, and improve response workflows with automation rules and Azure Logic Apps.

You will provide technical guidance to analysts, manage concurrent incidents, and communicate findings and recommendations to clients in a clear, professional manner.

Qualifications

• Senior-level cybersecurity experience in a Security Operations Centre, MDR, or incident response environment.
• Microsoft Sentinel and Defender XDR in production environments.
• Experience supporting multiple customers in an MSSP/MDR environment is strongly preferred.
• Advanced Kusto Query Language skills for investigation, threat hunting, detection development, and reporting.
• Hands-on experience creating and maintaining Microsoft Sentinel analytics rules, hunting queries, workbooks, automation rules, and playbooks.
• Experience building Azure Logic Apps for security orchestration and response, including connectors, APIs, authentication, permissions, error handling, and monitoring.

Responsibilities

• Lead the triage and investigation of complex or high-severity security incidents across multiple customer environments.
• Correlate endpoint, identity, email, cloud, network, and threat intelligence evidence to determine incident scope, root cause, and business impact.
• Develop investigation timelines, document evidence, identify attacker activity, and recommend containment and remediation actions.
• Coordinate escalations and response activities with clients, internal teams, and other technical specialists.
• Produce clear incident records, client communications, and post-incident findings.
• Design, tune, and maintain analytics rules, hunting queries, and playbooks to improve detection and response.

Skills

Microsoft Sentinel

Microsoft Defender XDR

Kusto Query Language

Azure Logic Apps

Incident response

Threat hunting

Customer-facing

Education

Bachelor's degree or diploma in cybersecurity, computer science, information technology, engineering

Tools

ServiceNow

Microsoft Defender for Endpoint

Job description

EY is seeking a senior, hands-on security operations analyst to support MDR services across multiple client environments. You will lead incident investigations using Microsoft Sentinel and Defender XDR, conduct threat hunting, and improve response workflows with automation rules and Azure Logic Apps.

You will provide technical guidance to analysts, manage concurrent incidents, and communicate findings and recommendations to clients in a clear, professional manner.