Security Operations

• Monitor security events within the 24×7 SOC.
• Provide rapid analysis and response to detected threats.
• Handle cybersecurity alerts and incidents escalated by Tier 1 SOC analysts.
• Analyze and qualify security alerts, including phishing, account compromise, malware, and lateral movement cases.
• Perform advanced analysis and recommend appropriate actions.
• Contribute to the initial incident response in collaboration with the relevant teams.
• Participate in the continuous improvement of SOC processes, detection rules, and metrics.
• Provide guidance to management within the scope of the role.
• Correlate events from SIEM, XDR, EDR, identity, email, network, and cloud platforms.
• Enrich alerts using logs, indicators of compromise, and threat intelligence.
• Determine the verdict, severity, potential impact, and required actions.
• Recommend or initiate initial mitigation, containment, or escalation measures.
• Rigorously document investigations, findings, decisions, and actions taken.
• Perform first-level technical analyses of endpoint and network logs and artifacts.
• Support and mentor Tier 1 SOC analysts in handling complex cases.
• Contribute to improving detection rules, investigation queries, SOC runbooks, and playbooks.
• Use approved artificial intelligence and automation tools to support investigation triage, enrichment, and documentation.
• Perform any other related duties as requested by the manager.

Cybersecurity Analyst – SOC

• Monitor security events within the 24×7 Security Operations Center (SOC).
• Provide rapid analysis and response to detected threats.
• Monitor, analyze, and resolve identified security incidents in real time.
• Continuously develop and improve the SOC’s 24×7 capabilities.
• Handle cybersecurity alerts and incidents escalated by Tier 1 SOC analysts.
• Analyze and qualify alerts, including phishing, account compromise, malware, and lateral movement cases.
• Perform advanced analysis and recommend appropriate actions.
• Contribute to the initial incident response in collaboration with the relevant teams.
• Improve SOC processes, detection rules, and metrics.
• Provide guidance to management within the scope of the role.
• Correlate events from SIEM, XDR, EDR, identity, email, network, and cloud platforms.
• Enrich alerts using logs, indicators of compromise, and threat intelligence.
• Determine the verdict, severity, potential impact, and required actions.
• Recommend or initiate initial mitigation, containment, or escalation measures.
• Rigorously document investigations, findings, decisions, and actions taken.
• Perform first-level technical analysis of endpoint and network logs and artifacts.
• Support Tier 1 SOC analysts in handling complex cases.
• Improve detection rules, investigation queries, SOC runbooks, and playbooks.
• Use approved artificial intelligence and automation tools to support triage, enrichment, and documentation.

Cybersecurity Analyst, SOC

• Monitor security events and provide technical analysis on alerts
• Lead information security incidents and employee investigations from response strategy through incident closure
• Provide incident updates to key stakeholders throughout investigations
• Deliver clear and concise security guidance for incident response and insider threat initiatives
• Coordinate development of services, capabilities, integrations, and technology implementations supporting security operations, incident response, and insider threat
• Create and maintain runbooks and automated workflows
• Assist with process refinement and implementation
• Collaborate with analysts, engineers, and key stakeholders on company-wide security initiatives
• Mentor and train security operations engineers on data collection, analysis, and technical reporting
• Champion Samsara’s cultural principles as the company scales globally and across new offices

Senior Security Operations Engineer

• Deliver Managed Security Services tasks on time with minimal supervision
• Monitor and resolve second-level support requests; escalate unresolved issues
• Develop, tune, and optimize security use cases, SIEM rules, and detection mechanisms
• Lead Tier-3 security incident investigations, containment strategies, and remediation
• Perform security analytics and provide client findings and recommendations
• Conduct vulnerability assessments, review threat intelligence, and prioritize risk mitigation
• Lead hypothesis-based threat hunts across client environments
• Build custom AI agents within SIEM/EDR for autonomous investigation and response
• Configure and administer SIEM and EDR platforms
• Perform root cause analysis and resolve recurring performance or configuration issues
• Provide technical knowledge transfer to clients and internal departments
• Build investigation playbooks and automated workflows
• Integrate platforms to improve threat detection and response
• Serve as a subject matter expert and deliver security posture reports, briefings, and recommendations
• Identify and escalate service trends, anomalies, and SLA breaches
• Handle technical account management and supervise technical service delivery
• Prepare and deliver client-facing quarterly and monthly meetings and tuning calls
• Recommend improvements for technical deficiencies, service performance, product utilization, bugs, and enhancements
• Mentor analysts and serve as an escalation point
• Improve workflows, reduce troubleshooting time and false positives, and drive automation
• Analyze and test system releases, upgrades, and patches
• Develop SOPs, knowledge base articles, and threat advisory documentation
• Conduct technical and incident-handling knowledge transfer sessions
• Attend training and participate in professional development activities

Senior Security Operations Specialist

• Monitor security events and provide technical analysis on alerts
• Lead information security incidents and employee investigations
• Develop incident response strategies and lead execution through incident closure
• Provide incident updates to key stakeholders throughout incidents
• Deliver clear, concise security guidance for incident response and insider threat initiatives
• Coordinate development of services, capabilities, integrations, and technology implementations supporting security operations, incident response, and insider threat
• Create and maintain runbooks and automated workflows
• Assist with process refinement and implementation
• Collaborate with analysts, engineers, and key stakeholders on company-wide security initiatives
• Mentor and train security operations engineers

• Detect and respond to threats in the Cyber Defense Center (SOC) by performing end-to-end investigations
• Assist with the development and implementation of internal processes
• Collaborate with different CDC teams to drive continuous improvement and automation
• Work on the full stack for detection and response, ranging from identity and endpoint to network and cloud
• Contribute to projects interfacing with other internal teams and customers to move the service forward
• React and respond to new threats
• Continuously learn and grow from responding to a variety of attacks

Security Operations jobs in Canada

Cybersecurity Analyst – SOC

Cybersecurity Analyst, SOC

Senior Security Operations Engineer

Senior Security Operations Specialist

Senior Security Operations Engineer

Junior Cyber Defender – SOC Analyst