About the role

SOC Analyst II role at BrokerLink responsible for advanced security event analysis and incident response in Canada. Leading investigations and improving security processes within the organization.

Responsibilities

Act as an escalation point for SOC Analyst I, providing guidance and expertise in analyzing security alerts
Take on a leadership role as the primary owner of incidents, coordinating response efforts and ensuring effective communication among all stakeholders
Investigate and resolve security tickets from end users
Monitor and respond to SIEM alerts, performing advanced triage and investigation of security incidents
Develop, refine, and implement SIEM detection rules, alerts, and reports
Utilize security automation and orchestration (SOAR) tools to streamline incident response
Support forensic investigations by analyzing logs and network traffic
Develop and conduct security awareness training for end users, developers, and IT teams
Conduct threat hunting exercises to proactively detect unknown threats
Track emerging threats, vulnerabilities, and attack techniques
Generate and present security reports and incident summaries to technical and leadership teams
Collaborate closely with security advisors on projects
Ensure security operations align with industry frameworks and regulatory requirements
Develop and maintain security playbooks for consistent incident handling

Post-secondary education in Computer Science, Information Technology, Cybersecurity, or a related field
3-5 years of experience in security operations, incident response, and threat analysis
Strong background in security incident management
Critical and analytical thinking skills to identify and resolve complex security incidents
Extensive experience with security tools such as SIEM platforms, EDR tools, vulnerability management tools, network monitoring tools
CrowdStrike EDR & NG-SIEM certifications preferred
Excellent verbal and written communication skills
Proficient in creating and reviewing documentation for policies, standards, guidelines, and procedures
Experience in security automation (SOAR) is a strong asset
Experience with cloud security monitoring for major cloud platforms is an asset
Industry certifications such as GCIH, GSEC, CySA+, or equivalent are an asset