Senior Cybersecurity Analyst
Toronto, ON | Permanent, Full-Time
The Role
Reporting to the Director of Cybersecurity, you’ll be a senior hands-on member of the security team. You’ll own detection and response, drive vulnerability remediation, and help set the direction of the security program. You’ll also be the go-to security expert for IT and business partners across the organization.
What You’ll Do
Detection & Incident Response
- Triage and investigate security alerts across endpoint, network, identity and cloud environments
- Lead investigations into phishing, malware, ransomware, account compromise and insider-risk events
- Find root causes and coordinate fixes with internal teams and third-party providers
- Build and refine IR playbooks, runbooks and escalation paths
- Take part in a shared on-call rotation
Threat Hunting & Risk
- Track the threat landscape and turn intelligence into improved detections
- Run proactive threat hunts using available telemetry
- Recommend practical, risk-based improvements to security controls
Vulnerability Management & Hardening
- Run vulnerability scanning and assessments across on-prem, cloud and application environments
- Work with infrastructure and application owners to prioritize fixes by risk
- Maintain hardening baselines aligned to CIS, NIST and ISO 27001
- Report on remediation progress, trends and key metrics
Security Tooling & Automation
- Manage and tune the security stack: SIEM, EDR/XDR, IDS/IPS, email security and scanning tools
- Automate repetitive work through scripting and SOAR-style workflows
- Evaluate and help roll out new security technologies
Governance & Awareness
- Support compliance work across PCI DSS, ISO 27001, NIST and Canadian privacy requirements
- Contribute to audits, risk assessments, control documentation and policy updates
- Help raise security awareness through training and practical guidance for staff
Leadership
- Mentor junior analysts and share knowledge across the team
- Contribute to the long-term cybersecurity roadmap
- Partner with infrastructure, cloud, networking, privacy and business teams
What You Bring
- 5+ years of hands-on experience in security operations, incident response or threat management
- A degree in Computer Science, IT, Information Security or a related field (or equivalent experience)
- Strong working knowledge of SIEM, EDR/XDR, vulnerability management, firewalls/networking, IAM, authentication and encryption
- Experience with the Microsoft security stack: Defender XDR, Sentinel, Intune and Entra ID
- Cloud security experience in Azure, AWS or GCP; hybrid environments are a plus
- Scripting skills in PowerShell, Python or similar are an asset
- Experience in a regulated or enterprise environment is an asset
- Certifications such as CISSP, CISM, GIAC, SC-200, AZ-500 or CEH are strongly preferred
- Clear communication, including the ability to explain technical risk to non-technical audiences
- Strong organization and judgment when juggling competing priorities
