Senior Security Analyst | Analyste sénior en sécurité

SITA Switzerland Sarl•Montreal, QC

7d•Hybrid

About The Position

Perform investigations and validation of security alerts and incidents to ensure accurate threat identification and response. Continuously improve detection quality and monitoring effectiveness while providing mentorship and guidance to SOC analysts. Drive operational excellence within the SOC by enhancing processes, strengthening investigative capabilities, and ensuring the timely identification, analysis, and escalation of security incidents to the Security Incident Response Team (SIRT).

Requirements

Advanced experience investigating and responding to security events using SIEM and EDR/XDR platforms.
Strong understanding of the incident investigation, triage, and escalation lifecycle within enterprise environments.
Expertise in analyzing and correlating logs from endpoints, cloud services, identity platforms, networks, firewalls, proxies, VPNs, and applications.
Proven ability to develop, tune, and optimize detection rules, correlation logic, and SOC use cases to improve threat detection.
Proficiency with security query languages such as KQL, Lucene, EQL, and Sigma, with scripting experience in PowerShell and/or Python.
Strong technical knowledge of Windows, Linux, Active Directory, Microsoft 365, Azure/AWS, networking, and common cyberattack techniques.
Deep understanding of the MITRE ATT&CK framework and its application to security monitoring, threat detection, and incident investigations.
Excellent analytical, communication, mentoring, and documentation skills, with a proactive mindset and commitment to continuous learning.
Bachelor’s degree in information technology, Cybersecurity, Computer Science, or a related discipline, with 3–5 years of experience in a SOC L2 Analyst or equivalent Security Operations role.
Industry-recognized cybersecurity certification such as SC-200, GCIH, GCIA, CySA+, ECIH, or a related credential demonstrating expertise in security operations and incident response.

Responsibilities

Act as the primary escalation point for junior SOC Analysts, providing expert guidance and oversight during security investigations.
Lead complex security incident investigations, validating alert classification, severity, scope, and escalation decisions.
Conduct advanced threat analysis and correlation across SIEM, EDR/XDR, cloud, identity, network, and endpoint environments.
Collect, analyze, and document evidence, developing investigation timelines and technical findings to support incident response activities.
Collaborate with SIRT and cross-functional technical teams, ensuring timely escalation of confirmed or suspected security incidents.
Develop, optimize, and maintain detection rules, correlation logic, SOC use cases, investigation playbooks, and alert tuning activities.
Identify detection gaps, monitoring deficiencies, and false-positive trends, applying the MITRE ATT&CK framework to strengthen threat detection and monitoring capabilities.
Mentor SOC Analysts through technical coaching, investigation support, quality reviews, and adherence to SOC standards.
Provide part-time support to the Vulnerability Management (VM) function, including vulnerability validation, risk prioritization, remediation support, and coordination with relevant stakeholders.
Produce technical reports, security assessments, operational metrics, and stakeholder briefings, while supporting tabletop exercises, post-incident reviews, and continuous improvement initiatives to enhance SOC processes, operational efficiency, and service quality.