Threat Analyst 3

This is a fully remote position, open to applicants in Canada.

📋 Description

• Oversee, investigate, and respond to alerts produced by the Sophos security stack, which includes EDR/XDR capabilities.

• Guide junior analysts through escalated cases.

• Conduct comprehensive analyses of suspicious activities to evaluate scope, impact, and risk.

• Detect and address cyber threats within customer environments by utilizing approved playbooks and tools.

• Record findings, investigative actions, and results in the MDR case management platform.

• Execute threat hunting across the MDR customer base.

• Examine phishing emails, suspicious binaries, and behavioral irregularities.

• Assist in detection tuning by identifying recurring false positives and proposing enhancements.

• Investigate threat actor behaviors, MITRE ATT&CK techniques, threat intelligence, emerging IOCs, active exploits, and vulnerabilities.

• Contribute to internal knowledge bases, documentation, and continuous improvement efforts.

• Participate in shift rotations and ensure thorough handovers between global teams.

• Support ongoing security incidents.

• Create cases, monitor progress, and follow up with clients until resolution.

• Interact with clients through chat, phone, and ticketing systems.

• Assist in the development and refinement of Security Operations processes, playbooks, and tools.

⛳️ Requirements

• A minimum of 3 years of hands-on experience in a Security Operations Center (SOC), Managed Detection and Response (MDR) environment, or a cybersecurity-focused IT role.

• Skilled in endpoint and network security tools, including EDR, IDS/IPS, and malware detection platforms.

• Proficient in working with Windows workstations and servers, as well as Linux or macOS environments.

• Capability to interpret and analyze Windows event logs and other telemetry data.

• Understanding of TCP/IP, protocols, routing, and traffic analysis.

• Experience in real-time incident response and threat investigations.

• Familiarity with threat hunting methodologies and attacker behavior patterns.

• Experience in containment, mitigation, and recovery during security incidents.

• Knowledge of persistence, privilege escalation, lateral movement, and defense evasion techniques.

• Acquainted with incident response workflows and security operations processes.

• Strong analytical thinking, troubleshooting skills, and attention to detail.

• Excellent communication skills for both technical and non-technical audiences.

• A customer-first mindset and professionalism.

• A bachelor's degree in information technology, Computer Science, Cybersecurity, or a related field, or equivalent practical experience.

• Willingness to participate in shift work, including nights, weekends, and holidays.

• Legal authorization to work in Canada without employer sponsorship.

🏝️ Benefits

• Eligibility for bonuses.

• A comprehensive benefits package.

• A remote-first working model.

• Employee-led diversity and inclusion initiatives.

• Annual charity and fundraising initiatives.

• Volunteer days.

• Global employee sustainability efforts.

• Global fitness and trivia competitions.

• Global well-being days.

• Monthly well-being webinars and training.