Senior SOC Analyst

Large incident response engagements can involve 20 or more responders working in shifts for weeks. Annual revenue from managed services has grown every year since 1995.

Looking for a Senior SOC Analyst who wants to stay somewhere for a while. This role handles alert triage, phishing investigations and vulnerability tracking for about 3,000 endpoints. The Cyber Defense team runs a 24/7 SOC. We need someone who can work through an alert queue and tell which ones matter. The company is based in Montreal, Canada. The team is distributed across several countries. Employment is through our payroll partner in the US. Salary is paid monthly in USD. Expect to work a schedule that overlaps with US Eastern business hours until about noon ET. You need a reliable internet connection and somewhere quiet to work.

Job duties:

• Help with user access reviews and offboarding audits.
• Write and update SOC runbooks and playbooks.
• Document incidents with timeline, impact and root cause.
• Review firewall, proxy, VPN and authentication logs for suspicious activity.
• Check threat intelligence feeds and IOCs against our environment.
• Escalate confirmed incidents and follow the incident response plan.
• Hand off open cases at shift change with clear notes.
• Monitor and triage alerts in Splunk, Microsoft Sentinel, QRadar or Elastic SIEM.

Qualifications:

• 5-7 years in an SOC, security analyst or IT security role.
• Basic scripting in PowerShell or Python.
• Ability to work shifts, including some nights, weekends or holidays as scheduled.
• Familiarity with the MITRE ATT&CK framework.

Pluses:

• Cloud log analysis (CloudTrail, Entra ID sign-in logs)
• CySA+, GCIH, GCIA or BTL1 certification.

Pay and benefits:

Salary range: $125,000 - $147,000 annually

• Monthly internet allowance.
• Annual salary review.
• Co-working space stipend.
• Wellness allowance.

Cedartrack provides equal employment opportunities to all employees and applicants.

New hires usually start two to three weeks after accepting an offer.

Applicants must be authorized to work in the U.S.

Start: Immediately.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Cedartrack.