Security Analyst II – Incident Response

Intact

. Monitor, triage, and investigate security alerts and incidents across endpoint, network, identity, cloud, and application environments .

Posted 11/5/2026full-timeMontréal • CanadaMid-LevelSenior💰 CA$80,700 - CA$98,700 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in incident response methodologies, security operations best practices, and the cyber kill chain, with a strong focus on analyzing security events and improving detection capabilities. Proficient in collaborating with cross-functional teams to enhance security measures and respond effectively to incidents.

Highest-signal resume keywords

Incident Response MethodologiesSIEM ExperienceCyber Kill Chain KnowledgeVulnerability Management ToolsStrong Analytical Skills

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseSecurity OperationsDigital ForensicsThreat AnalysisLog CorrelationMalware AnalysisPhishing InvestigationData Exfiltration PreventionCloud SecurityNetwork Security

Soft Skills

Excellent Communication SkillsProblem-Solving SkillsCollaborative MindsetStrong Documentation SkillsAbility to Manage Multiple Investigations

Tools & Technologies

EDR/XDRVulnerability Management ToolsNetwork Monitoring ToolsEmail Security ToolsAzureAWS

Certifications & Qualifications

GCIHGCIAGCFAGCFECISSPSecurity+CySA+CEH

Industry Keywords

CybersecurityFinancial ServicesInsuranceRegulated EnvironmentEnterprise Environment

Tech Stack

Tools & technologies

AWSAzureCloudCyber Security

About the role

Key responsibilities & impact

Monitor, triage, and investigate security alerts and incidents across endpoint, network, identity, cloud, and application environments
Perform incident response activities, including containment, eradication, and post-incident follow-up
Analyze security events using SIEM, EDR/XDR, network monitoring, email security, and vulnerability management tools
Correlate logs and telemetry to identify attack patterns, root causes, and indicators of compromise
Identify, assess, and recommend information security solutions meeting business and security needs
Develop and execute incident response playbooks, procedures, and escalation processes
Improve detection rules, dashboards, and incident response use cases
Document investigations, technical findings, timelines, impact assessments, and recommended remediation actions
Escalate complex or high-impact incidents to senior analysts, incident commanders, and relevant stakeholders
Collaborate with infrastructure, cloud, identity, application, privacy, legal, and risk teams
Support vulnerability remediation, attack-surface reduction, and security monitoring coverage improvements
Participate in security exercises, tabletop scenarios, lessons-learned reviews, and continuous improvement initiatives
Contribute to security operations metrics, reporting, knowledge articles, and operational documentation
Participate in an on-call or after-hours incident response rotation
Stay current with information security newsfeeds and threat actor tactics and techniques
Learn new technologies

Requirements

What you’ll need

Bachelor’s degree in information technology, or any combination of equivalent education and experience
3+ years of experience in cybersecurity, security operations, incident response, digital forensics, or a related field
Hands-on experience investigating and responding to security incidents in enterprise environments
Strong knowledge of incident response methodologies, the cyber kill chain, MITRE ATT&CK, and security operations best practices
Experience with SIEM, EDR/XDR, vulnerability management, network security, identity security, and cloud security tools
Practical understanding of phishing, credential theft, malware, ransomware, lateral movement, persistence, privilege escalation, and data exfiltration
Strong analytical, investigative, and problem-solving skills
Excellent written and verbal communication skills, including explaining technical issues to technical and non-technical audiences
Strong documentation skills and disciplined incident records and evidence maintenance
Ability to manage multiple investigations, prioritize competing demands, and make sound decisions during rapidly evolving incidents
Collaborative mindset and ability to work effectively with cross-functional teams
Relevant certifications such as GCIH, GCIA, GCFA, GCFE, CISSP, Security+, CySA+, CEH, or equivalent credential would be an asset
Experience with Azure or AWS would be an asset
Experience in a regulated, financial services, insurance, or large-enterprise environment would be an asset
Must be eligible to work in Canada
For candidates located in Quebec, bilingualism is required to interact regularly with English-speaking colleagues across the country

Benefits

Comp & perks

Flexible work arrangements and a hybrid work model
Possibility to purchase up to 5 extra days off per year
Multiple benefits supporting physical and mental wellbeing, including telemedicine and Wellness account
Share plan and other savings: up to 12% of salary or even more
Annual bonus plan with a 10% target and potential payout up to double the target, subject to personal and company performance
Employee Share Purchase Plan (ESPP), with Intact matching 50% of net shares
Defined benefit pension plan with opportunity to receive guaranteed income for life
35-hour workweek