Security Specialist

Beem Credit Union•, BC

96d•CA$95,500 - CA$119,400•Hybrid

About The Position

The Security Specialist will drive enhancements in threat detection, incident response, vulnerability management and cloud security. This role requires strong expertise in Microsoft Azure security technologies, SIEM operations, threat intelligence, and security automation, ensuring Beem’s defenses are proactive, scalable, and resilient against modern cyber threats. As a key member of the security team, you will work hands-on with Microsoft Sentinel, Sentinel Data Lake, Defender XDR, KQL-based threat hunting, SOAR automation, and UEBA to optimize Beem’s Security Operations Center (SOC) capabilities. You will also play a pivotal role in improving cloud security posture management (CSPM), identity security, and endpoint protection. The Security Specialist will be responsible for strengthening and maturing Beem’s Security Operations capabilities while overseeing the operational governance of a Managed Security Services Provider (MSSP) delivering SOC services. This role is open to remote or hybrid working arrangements within British Columbia.

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field.
6-8 years of hands-on experience in security operations, focusing on cloud security, incident response, and vulnerability management.
Extensive experience with Microsoft security technologies, including Azure Security Center, Microsoft Defender XDR, Microsoft Sentinel, Enterprise Privileged access management and Cloud Security solution.
Proficiency in KQL scripting for threat hunting, security analytics, and incident response.
Strong understanding of cloud security principles, the shared responsibility model, and secure cloud architecture.
Experience leading security operations projects to enhance incident detection, response, and automation.
Strong problem-solving skills, particularly in high-pressure incident response scenarios, including leading root cause analysis (RCA).
Ability to collaborate cross-functionally, communicate effectively with technical and business teams, and influence security best practices.
Agile mindset with a continuous improvement approach to enhance threat detection, response, and security governance.

Nice To Haves

CISSP (Certified Information Systems Security Professional)
Microsoft Certified: Azure Security Engineer Associate
Microsoft Certified: Cybersecurity Architect Expert

Responsibilities

Lead threat detection engineering by writing advanced KQL-based detection rules in Microsoft Sentinel to identify malicious activities, lateral movement, privilege escalation, and anomalous cloud access.
Manage and fine-tune SIEM correlation rules, threat intelligence integrations, and alerting mechanisms to reduce false positives and increase detection efficiency.
Deploy and optimize Microsoft Defender for Endpoint, Defender for Cloud, and Defender for Identity to detect host, cloud, and identity-based attacks.
Lead the deployment, configuration, and continuous optimization of Wiz (Cloud Security platform) to ensure comprehensive visibility across cloud infrastructure, identities, workloads, containers, and data services.
Develop custom detection logic for MITRE ATT&CK TTPs, leveraging Sentinel Analytics rules, Azure Logic Apps, and Machine Learning-based UEBA analytics.
Integrate external threat intelligence feeds into Sentinel and fine-tune detection models for real-time attack detection.
Conduct periodic validation of log coverage to ensure critical data sources (identity, endpoint, network, cloud, SaaS) are continuously ingested without gaps.
Own the development, standardization, and maintenance of comprehensive documentation across the enterprise security toolset, including Microsoft Sentinel, Defender XDR, Wiz, cloud security controls and identity platforms.
Develop and maintain Standard Operating Procedures (SOPs) for monitoring, alert triage, escalation, tool health validation, vulnerability management, and incident response workflows.
Own and operationalize enterprise Privileged Access Management, Privileged Identity Management and Identity & Access Management controls, ensuring least-privilege enforcement, telemetry integration into Microsoft Sentinel, development of identity-based detection use cases, and continuous monitoring to prevent, detect, and respond to privileged and account compromise threats.
Serve as an escalation point for security incidents, performing forensic analysis, memory dumps, and endpoint triage using Microsoft Defender and Sysinternals tools.
Develop and execute incident response runbooks for ransomware, cloud account takeover, data exfiltration, and insider threats.
Automate security response workflows using SOAR capabilities in Microsoft Sentinel, Logic Apps, and Power Automate.
Conduct log analysis and correlation from diverse data sources, including Sentinel, Sentinel Data Lake, Wiz Cloud Security, Azure AD, Defender XDR, Firewalls, DNS logs, and SaaS applications.
Perform digital forensics and malware analysis, leveraging tools like Velociraptor, Sysmon, and Windows Event Forwarding (WEF).
Lead threat hunting exercises, proactively identifying sophisticated adversarial activities by analyzing endpoint telemetry, and Azure AD logs.
Enhance vulnerability scanning and remediation workflows, integrating results from Wiz, Qualys, or Tenable.io into JIRA or ServiceNow.
Design and implement custom security baselines for Windows, Linux, and Azure cloud resources using Microsoft Intune, GPOs, and Desired State Configuration (DSC).
Harden Azure environments by applying CIS Benchmarking, Microsoft Secure Score improvements, and Azure Policy configurations.
Secure Kubernetes Services and containerized workloads, ensuring RBAC enforcement, network segmentation, and container runtime security.
Work with IAM teams to optimize Conditional Access Policies, Identity Protection rules, and Just-In-Time (JIT) access policies in Azure AD.
Develop and track KPIs and KRIs to measure and report on security posture, vulnerabilities, and incident response times to senior leadership.
Design, implement, and operationalize comprehensive health monitoring across the enterprise security toolset (including Microsoft Sentinel, Microsoft Defender XDR, Azure security services, endpoint agents, log connectors and automation playbooks) for proactive monitoring and remediation.
Implement threat intelligence initiatives to proactively identify and mitigate emerging threats, collaborating with external partners for intelligence sharing.
Continuously assess and enhance security processes, identifying gaps in security operations, technology, and staffing, and proposing improvement strategies.
Assist in responding to internal and external audits, ensuring alignment with security policies and regulatory requirements.
Maintain a deep understanding of security frameworks and standards, such as NIST, CIS, and MITRE ATT&CK, and align security operations accordingly.
Provide security advisory and governance support for IT and engineering teams, ensuring adherence to secure-by-design principles.