Specialist, Cyber Operations

Air Canada•Dorval, QC

About The Position

Being part of Air Canada is to become part of an iconic Canadian symbol, recently ranked the best Airline in North America. Let your career take flight by joining our diverse and vibrant team at the leading edge of passenger aviation. The Specialist, Cyber Operations will be working in a fast-paced and innovative environment supporting one of North America’s top airlines. This role requires strong analytical capabilities, technical depth, and sound judgment in dynamic and high-pressure situations. As a Specialist within the Cyber Security Operations Centre (CSOC), you will be a key contributor to advanced monitoring, detection engineering, and incident response activities. You will support the continuous improvement of detection capabilities and contribute to protecting Air Canada’s systems, data, and customers. The Cyber Security Operations Centre is the first line of defense to protect Air Canada and our customers.

Requirements

A relevant University degree, technical certification, and/or equivalent experience commensurate to the role.
5+ years of IT, security operations, or cyber security experience in a large enterprise environment.
Strong understanding of network protocols, packet flow, TCP/UDP traffic, and security technologies including firewalls, IPS, proxy, WAF, and endpoint detection solutions.
Experience working in a 24/7 operational environment (shift work and on-call support may be required).
Strong analytical, problem-solving, and decision-making skills.
Ability to communicate effectively and collaborate with stakeholders at all levels of the organization.
Ability to work effectively under pressure in rapidly changing environments.
Ability to manage multiple priorities in a fast-paced environment.
Demonstrated commitment to continuous service improvement.
Experience troubleshooting, tuning, or improving detections that produced false positives or failed to detect expected activity.
Attention to detail: Candidates are expected to identify inconsistencies and unclear technical requirements, demonstrate judgment in determining whether to question, ignore, or clarify instruction.
Experience with threat detection platforms such as Microsoft Sentinel, Microsoft Defender for Endpoint, or Palo Alto Cortex XDR, including familiarity with legacy modules such as “Insight Offline Alert Collector”.
Experience operating both agent-based endpoint detection solutions and fully agentless, real-time endpoint detection systems.
Experience developing and tuning SIEM use cases and correlation rules, including stateless behavioral baselines.
Demonstrate punctuality and dependability to support overall team success in a fast-paced environment.
Candidates must be eligible to work in the country of interest at the time any offer of employment is made and are responsible for obtaining any required work permits, visas, or other authorizations necessary for employment. Prior to their start date, candidates will also need to provide proof of their eligibility to work in the country of interest.
Based on equal qualifications, preference will be given to bilingual candidates.

Nice To Haves

Certification in Information Security (Security+, GCIA, OSCP or equivalent).

Responsibilities

Manage, maintain and optimize CSOC technologies, including SIEM, SOAR, and associated detection and response platforms.
Perform Digital Forensics Incident Response (DFIR) and threat hunting activities using relevant actor TTPs and IOCs.
Enhance as well as maintain detection and response technologies to address the evolving cyber threat landscape.
Act as an escalation point for cyber security analysts responding to incidents.
Create, and maintain documentation including root cause analysis, SOPs, and incident response procedures.
Participate in initiatives to improve IT efficiency, customer experience, and cyber security posture.
Measure and report on key service-level metrics demonstrating CSOC effectiveness.
Produce and contribute to Threat Intelligence related to observed threats.
Develop and communicate operational security objectives and support team alignment.
Collaborate with stakeholders to collect and analyze information during investigations.
Review and analyze data from multiple internal and external sources.
Communicate findings and provide actionable recommendations.
Facilitate business analysis and technology integration efforts.
Drive detection use case development and monitoring processes.
Build relationships across the organization to support secure and reliable operations.
Maintain up-to-date knowledge of evolving threats, technologies, and security practices.