Security Operations Centre (SOC) Analyst
关于角色 你对网络安全有什么热情？你愿意为公共利益应用你的技术和调查技能吗？如果是这样，我们有一个令人兴奋的机会！Cybera 是一个非营利机构，其使命是通过使用和推进数字技术改善阿尔伯顿人的生活。我们服务于该省的教育，研究和政府部门。为了支持高等教育部门在自卫而免受网络伤害，Cybera 建立了一个区域安全运作中心 (rSOC) 来监测，检测和应对网络安全威胁。作为 SOC 分析师 （夜班）,你将有机会应对事件并产生现实世界的影响。在一天之间独立工作，成功的关键因素包括有效识别和调查事件，管理升级以及与我们的成员国机构合作整个事件生命周期.Cybera 致力于持续学习和专业发展，以便你可以提升你的网络安全技能和经验，同时帮助我们保护中学后机构。你将做什么 - 进行主动监测，调查和升级安全事件。- 通过分析相关事件细节和总结信息识别潜在或涉嫌的入侵尝试和妥协。- 使用开源和部门情报来调查恶意 URL,域名和 IP. - 根据行业常见实践和供应商建议提供针对特定威胁的缓解指导和支持。- 与其他 rSOC 团队成员合作不断开发和完善异常或可疑事件的调查方法。-积极贡献并维护 rSOC 过程和程序知识库。- 利用游戏手册，指南和各种技术进行事故调查。- 报告日志覆盖的漏洞，分析问题和大量虚假阳性信息。- 根据已建立的 SLA,作为成员报告的安全事件和服务请求的第一点接触。- 应用网络安全和隐私原则以满足组织要求。你带来的教育和经验 - 网络安全文凭或类似技术培训在网络安全领域。- 优先获得相关证书，如 CompTIA Security+,CySA+等资格。- 证明对网络安全的热情和承诺。
查看英文原文
About the role
Are you passionate about cybersecurity? Are you eager to apply your technical and investigative skills for the public good? If so, we have an exciting opportunity for you!
Cybera is a not-for-profit agency whose mission is to improve the lives of Albertans through the use and advancement of digital technologies. We serve the province’s education, research and government sectors. To support the higher education sector in defending themselves from online harms, Cybera has established a regional Security Operations Centre (rSOC) to monitor, detect, and respond to cybersecurity threats..
As a SOC Analyst (night shift), you will have an opportunity to respond to incidents and make a real-world impact. Working independently overnight, your key factors for success include the ability to effectively identify and investigate incidents, manage escalations, and work with our member institutions throughout the incident lifecycle. Cybera is committed to continuous learning and professional development so you can advance your cybersecurity skills and experience while helping us safeguard post-secondary institutions.
What you’ll do
- Conduct proactive monitoring, investigation, and escalation of security incidents.
- Identify potential or suspected intrusion attempts and compromises by analyzing relevant event details and summary information.
- Investigate malicious URLs, domains, and IPs using open-source and sector intelligence.
- Provide mitigation guidance and support in response to identified threats, based on common industry practices and vendor recommendations.
- Continuously develop and refine investigative methods for anomalous or suspicious events, in collaboration with other rSOC team members.
- Actively contribute to and maintain the knowledge base for rSOC processes and procedures.
- Utilize playbooks, guidelines, and various techniques for investigating incidents.
- Report gaps in log coverage, parsing issues, and high-volumes of false positives.
- Act as the first point of contact for member-reported security incidents and service requests in accordance with established SLAs.
- Apply cybersecurity and privacy principles to meet organizational requirements.
What you bring
Education and experience
- Cybersecurity diploma or equivalent technical training in cybersecurity.
- Relevant certifications preferred, such as CompTIA Security+, CySA+, or similar qualifications.
- Demonstrated passion for cybersecurity and a commitment to continuous learning.
- Hands-on experience through academic projects, Capture the Flag (CTF) competitions, or practical labs (e.g. HackTheBox, LetsDefend) is highly desirable.
- Familiarity with following documented cybersecurity processes and procedures, along with a strong willingness to learn incident response workflows.
- Previous experience working night shifts or working independently is an asset.
Skills
- Understanding of cybersecurity threats and risks to the academic sector.
- Experience in identifying and investigating security incidents.
- Practical understanding of cybersecurity concepts, such as incident response practices, vulnerability management, and IT service management.
Technical proficiencies
- Experience with SIEM and UEBA technologies, and following playbooks for incident response.
- An understanding of the MITRE ATT&CK framework.
- Experience with investigating suspicious sign-ins, phishing, malware, and network log analysis.
- Ability to document and explain technical information clearly and concisely to diverse audiences.
- An understanding of TCP/IP and other network protocols.
- Experience with using threat intelligence feeds; problem solving and analytical thinking skills.
- Strong documentation and communication skills.
These requirements represent an ideal candidate. The potential of the individual’s background and experience to meet the responsibilities and expectations of the role is considered in all instances.
This is your opportunity to be a part of a newly formed rSOC that will change the security landscape for post-secondary institutions!
Schedule and conditions of employment
The rSOC operates 24 hours a day, 7 days a week. This role is for a dedicated night shift covering overnight hours from 10:00 pm to 6:00 am ABT (Alberta time), including weekends and holidays.
Selected candidates will be required to provide a satisfactory employment and criminal record check as a condition of employment.
Compensation and location
Preference will be given to Calgary, Alberta residents; however, remote work within Canada will also be considered. Salary will be commensurate with experience. No relocation costs will be awarded.
Benefits of working at Cybera
This is your opportunity to work for a flexible, tech-forward not-for-profit that is helping Canada become a more equitable place to work, learn, and play! We offer:
- A remote working environment.
- Highly supportive and inclusive work culture.
Benefits:
- Health & Vision benefits from day 1.
- Long & Short term disability benefits from day 1.
- Flexible Health Spending Account (after successful probation).
- Annual professional development funds.
- Regular Lunch & Learns covering department updates to EDI topics.
- RRSP program (after successful probation).
- Healthy snacks in the office – and sometimes unhealthy snacks.
- 10 days per year to use for sick time or mental health breaks.
- The opportunity to invest in yourself and your career.
How to apply
This posting will remain open until a suitable candidate is found. Your application should include a resume and a short response (in your own words) to four application questions listed below. Your answers should demonstrate how your skillset matches the position requirements (of course we don't expect you to have them all!) While we appreciate all applications, only candidates selected for an interview will be contacted. No phone calls or recruiter assistance at this time, please.
All qualified applicants will receive consideration for employment without regard to race, religious beliefs, colour, gender, disability, age, ancestry, place of origin, marital status, source of income or family status of that person or of any other person.
Number of hires for this role: 2