Senior Security Operations Centre Analyst

At ATCO we are challenging the status quo and aspiring to make a positive impact on the world. With our commitment to accelerating the energy transition, we've become a meaningful player in the future of sustainable energy. While the rest of the industry is thinking, we are executing and bringing ideas and solutions to life. ATCO has a strong entrepreneurial history and a global network that enables us to innovate, overcome challenges, and create something transformative in the energy transition space. Be on the industry leading edge with us and help shape our world for years to come.

The Senior Security Operations Centre (SOC) Analyst is a critical position within the Security Operations Center (SOC) responsible for leading incident response for escalated, major and complex incidents, threat hunting, and performing digital forensics. Reporting to the Security Operations Manager, this role requires expertise in analyzing complex security incidents, managing escalations from SOC Analysts, performing digital forensics on compromised systems, conducting threat hunts and implementing advanced security measures.

You will ensure that security events are effectively detected, investigated, and mitigated. This role also involves driving continuous improvement efforts within the SOC to enhance the organization's security posture and reduce the risk of cyber threats.

Always there. Anywhere. That's us! A team committed to delivering inspired solutions for a better world. We care for our communities and each other, and we are committed to showing up for those who need us. We value and encourage diversity, and we have the courage to do the right thing, even when it's hard.

What Else You Get To Do

• Continuously monitor security alerts and events from various sources such as SIEM (Security Information and Event Management) systems, IDS/IPS (Intrusion Detection/Prevention Systems), firewalls, Endpoint Protection and other security tools
• Investigate and respond to security incidents, including malware infections, phishing attacks, and unauthorized access attempts. Investigate and manage incident escalations from SOC Analysts and act in a primary responder role for major or complex incidents
• Analyze and assess potential threats, vulnerabilities, and risks to the organization's information systems. Document notable threats and facilitate IOC sharing within the team
• Proactively search for signs of malicious activity or potential threats within the network. Perform threat hunting activities during incidents and for published IOC's or threat notices
• Perform digital forensics on compromised systems, analyzing artifacts, logs, and data remnants to determine the nature and impact of security breaches. Use forensic analysis tools to recover deleted files, uncover attack methods, and reconstruct attack timelines
• Develop and fine-tune detection rules and signatures to improve the accuracy and effectiveness of security monitoring tools
• Assist with maintenance of security platforms, ensuring they are tuned and configured correctly. Review and perform false positive tuning and Implement IOC blocking on security platforms
• Provide feedback on log coverage, rules and detections to minimize false positives and enhance detection capabilities
• Document and report on security incidents, generate reporting and collect stats for monthly metrics and reporting
• Participate in post-incident reviews and contribute to the development and implementation of security policies, procedures, and best practices.

Who You Are:

• Bachelor's degree in Cybersecurity, Information Technology, or related field, or equivalent work experience

• At least 5-8 years of experience in a Security Operations Center (SOC) or similar security monitoring environment

• Knowledge of common attack techniques, tools, and tactics (e.g., MITRE ATT&CK framework, malware analysis)

• Some Certifications are an asset:
  • Certified Information Systems Security Professional (CISSP)
  • Certified Ethical Hacker (CEH)
  • GIAC Security Expert (GSE)
  • GIAC Certified Incident Handler (GCIH)
  • GIAC Cyber Threat Intelligence (GCTI)
  • Certified Computer Forensics Examiner (CCFE) or GIAC Certified Forensic Examiner (GCFE)
  • CompTIA Security+.

• Ability to recognize common attack vectors such as phishing, DDoS, and malware
• Solid understanding of networking, operating systems (Linux/Windows), and security principles
• Experience with incident detection, escalation, and response
• Proficiency with SIEM tools (e.g., Splunk, ArcSight, QRadar, or similar platforms)
• Proficiency with security technologies like firewalls, intrusion detection/prevention systems (IDS/IPS), endpoint protection, and vulnerability scanning tools
• Experience with security orchestration tools (SOAR)
• Proficiency with scripting languages (PowerShell, Python)
• Proficiency with forensic tools and procedures and threat intelligence frameworks and tools
• Excellent communication skills, with the ability to clearly explain technical issues to non-technical stakeholders
• Ability to work in a 24/7 environment including weekends, holidays and nights
• Requires the ability to fulfil on call duties and ensure impacting and priority incidents are resolved in a timely manner including weekends, holidays and nights.