Intermediate Security Analyst - Cyber threat hunting, contract position

Number of positions 1, 6month contract to start, possible extension for another 6months

Location: Toronto, ON, or Montreal PQ

Must be eligible to work in Canada

Hybrid position, 2-3d/w onsite either of the locations

7hr/d billing, bilingual is highly desired for Montreal location

Roles and responsibilities:

This role is more on the IT Security support side, most tasks will be under the scope of Level2 support, with some Level 3, or level 1. Cyber threat hunting, CyberArk is mandatory.

The work will be mainly consisting of clearing an access backlog. This is a very hands-on role.

Develop Hunting Queries based on CTI inputs. Review & proactively capture cyber activities in the IFC environment based on any suspicious activity. Collaborate with the Red team in analyzing Immediate threats triggered by Cymulate. Participate in Purple team exercises to conduct attack emulation tests. Work closely with the Incident Response team during investigations and increase automation (automated detection and response. Handle other ad hoc requests as directed by the Manager, Cyber Threat Monitoring.

Executes daily operational and administrative duties related to security components in technical infrastructure to ensure good functioning and to maintain expected security level. Ensures that protection obtained by security systems is optimal by making sure dynamic rules (for example, virus signatures) are done timely and protection is complete. Executes periodical review procedures for IT security procedures by producing relevant reports and by following up with accountable stakeholders. Analyzes events logs with available tools and investigates and/or escalates as required potential or real security incidents. Performs necessary follow-up as needed with the people involved to ensure unnecessary access is deleted after termination or moving, and unused access codes are deleted if applicable. Processes daily requests to add, modify and delete computer systems access in line with established guidelines by encoding required rules in access control systems.

Must have skills/experience/qualifications:

A minimum of 2-3yrs of the following

PowerShell Scripting

Endpoint Detection and Response CrowdStrike, Sentinel One, Defender.

IAM (Identity and Access Management): Entra ID (formerly Azure AD).

Nice to haves:

Experience with Cymulate is a plus