Security Operations Analyst, AlphaSense

• 2–4+ years of hands-on experience in a SOC, or security operations role with direct alert triage responsibility
• Solid understanding of the MITRE ATT&CK framework — you use it to label and communicate attacker behavior, not just reference it
• Working knowledge of EDR tooling: process tree analysis, behavioral detection review, and basic endpoint artifact interpretation
• Familiarity with SIEM-based investigation: querying logs, correlating events across sources, and building timelines from normalized data
• Understanding of foundational network protocols (TCP/IP, DNS, HTTP/S, TLS) and how attackers abuse them
• Exposure to cloud security monitoring ex. AWS or GCP — including audit log review and IAM-related alert investigation
• Experience investigating identity-based alerts in an enterprise identity provider (e.g., Okta, Entra ID, or equivalent)
• Strong written communication: your case notes are accurate, structured, and useful to someone who wasn’t there

Desirable

• We are hiring Security Operations Analyst II to join our Security Operations team in a fully remote capacity from Canada. This role sits at Tier 1–2 in our operating model — you are past the stage of learning what alerts look like and ready to own triage, perform structured investigations, and contribute to detection quality
• You will handle the day-to-day alert queue, investigate escalated or ambiguous cases, handle incidents and work closely with senior analysts and the Security Operations Manager to close coverage gaps
• We expect you to think analytically, document thoroughly, and operate with growing independence. You will be supported by experienced colleagues and a mature toolset, but you are expected to bring real investigative instinct and a curiosity to grow to the role from day one
• Alert Triage & Investigation:
• Monitor and triage alerts across endpoint, network, cloud, runtime and identity data sources with accuracy and appropriate urgency
• Perform structured investigations on escalated or ambiguous alerts: pivot across log sources, correlate events, and build a coherent timeline
• Classify alerts correctly — true positive, false positive, or benign — with documented rationale, not just a verdict
• Identify scope and blast radius on confirmed incidents: affected users, systems, and data before escalating or containing
• Escalate to senior analysts with a complete investigation package — context, evidence, timeline, and a hypothesis
• Incident Response Support:
• Participate in active incident response under senior analyst or manager direction: evidence collection, log pulls, timeline reconstruction
• Execute containment actions — endpoint isolation, account suspension, token revocation — as directed with documented rationale
• Maintain accurate and timely case documentation throughout the incident lifecycle
• Contribute to post-incident timelines and assist with root cause documentation
• Cloud & Identity Security Monitoring:
• Monitor cloud audit logs and native threat detection findings for suspicious IAM activity, unusual API calls, and access anomalies
• Investigate identity provider events: suspicious logins, MFA bypass attempts, session anomalies, and unauthorized app assignments
• Recognize common cloud-native attack patterns: credential abuse via metadata service, privilege escalation via IAM role assumption, and storage misconfiguration access
• Correlate cloud-side events with endpoint and network telemetry to build a fuller picture of attacker activity
• Detection & Quality Improvement:
• Flag false positives and noisy detections with enough context for a senior analyst or detection engineer to tune them
• Identify gaps in existing detection coverage based on alert patterns you observe during triage
• Apply knowledge of MITRE ATT&CK to label attacker techniques and communicate findings consistently
• Contribute to runbook accuracy by flagging outdated steps or missing guidance encountered during investigations
• Participate with Detections Engineers to build detections and contribute to automating activity with an Engineering mindset
• Documentation & Communication:
• Write clear, concise case notes that a colleague could pick up mid-investigation without needing to re-investigate from scratch
• Produce shift handoff summaries that accurately represent open cases, pending actions, and investigation status
• Communicate incident updates to the Security Operations Manager with sufficient clarity to brief upward without re-investigation