129 Incident Response jobs in Canada

Job Description

Paladin Security is Hiring a Security Operations Centre Operator!

Paladin Security is hiring a skilled and detail-focused Security Operations Centre (SOC) Operator for our healthcare client, University Health Network – West Park . This critical role involves overseeing a hospital command centre, coordinating emergency response, and managing dispatch and access control systems.

• Job Type: Full-Time (Temporary)
• Location: Toronto, ON (UHN West Park – 170 Emmett Ave)
• Shift: Continental rotation (0700–1900 / 1900–0700)
• Pay: $23.98/hour

• Lead shift operations in the healthcare security command centre
• Operate and monitor CCTV, access control, life safety, and fire panel systems
• Coordinate deployment and movement of security staff across the facility
• Handle emergency communications and make overhead announcements
• Issue visitor and contractor badges, manage keys and Lost & Found
• Train new team members and support with special projects

Requirements

• Valid Ontario Security Guard License
• Valid First Aid & CPR Level C Certification (WSIB Approved)
• Proof of full COVID-19 vaccination
• Immunization Records for MMR, Varicella, and 2-Step TB Skin Test
• At least 2 years of experience in a security role
• Experience working in a healthcare security setting
• Experience with dispatch, radio communications, or command centre operations
• Strong written and verbal communication in English
• Eligible to work in Canada

• Post-secondary education in Criminology, Border Services, or Police Foundations
• Familiarity with access control and dispatch software
• Prior experience leading teams or training new hires

Benefits

• Medical, Dental, and Vision Insurance
• Paid Vacation, Sick Days, and Holidays
• Weekly pay and professional development opportunities
• Supportive, inclusive work culture
• Advancement within Paladin’s healthcare security programs

Job Description

Salary:

Job Description

The Jewish Security Network (JSN) of Greater Toronto seeks to hire qualified and dedicated staff to run the Security Operations Centre (SOC). The successful candidates will play a vital role in ensuring the safety and protection of the Toronto Jewish community by supporting the operations of the 24/7 command centre, working within a dynamic team of support staff.

Reporting to the Manager, Security Operations Centre, SOC Operators will serve as the first point of contact for all incoming calls for support and field intelligence reports. Through monitoring a wide array of digital assets via centralized software and phone hotlines, SOC Operators will synthesize large amounts of critical information quickly, coordinate routine and emergency incident communications, and create comprehensive records of security-related incidents.

Responsibilities:

• Operate the SOC on a shift-basis using sophisticated technology and supporting assets
• Manage incidents as they arise, manage appropriate responses, and conduct detailed record keeping
• Provide direct support to Jewish institutions, agencies, and/or personnel during emergencies
• Tend to crises using a set of pre-determined protocols, working as part of the SOC and the larger JSN team
• Coordinate with other internal and external security assets as needed
• Attend regular meetings and trainings, and assist with peer-to-peer training sessions
• Regularly conduct drills of the system, manage technical troubleshooting, and any other maintenance activities as assigned
• Assist JSN with event security as needed
• Work on a rotating shift schedule, including nights, weekends, and holidays, to ensure the SOC is operational 24/7

We are seeking someone who possesses the following skillset:

• Strong interpersonal skills and customer-service experience
• Clear operational mindset, with the ability to manage stress well and work efficiently under immense pressure required
• Strong problem-solving skills and detail orientated
• Strong experience working with software and large technological assets, including as a back-end user
• Exceptional computer skills, including the ability to type >50 words per minute in English
• Fluent English speaker, reader, and writer required. Proficiency in Hebrew considered an asset
• Strong working knowledge of Torontos Jewish community and its institutions considered a major asset
• Familiarity with situational awareness and other security strengths considered an asset
• Geopolitical awareness, knowledge of relevant global events, and cultural sensitivity is required
• A graduate of a Bachelors Degree program or college equivalent considered a major asset
• Availability to work regular shifts as assigned including on weekends, Jewish holidays, and evenings/overnight is required
• Familiarity with Microsoft Suite considered an asset

How To Apply

This full-time, on-site position will pay a competitive salary. Successful applicants will be required to pass a police background check and must be permitted to work in Canada.

To apply for this position, please send your cover letter and resume to Additionally, please fill out this form:

Only applications submitted with cover letters, resumes, and a completed application form will be considered. Our sincere appreciation to all those expressing interest in this position, however, only those applicants invited for an interview will be contacted. No recruiters please.

JSN is an equal opportunity employer and is committed to creating an accessible and inclusive organization. We adhere to barrier-free and accessible employment practices in compliance with the Accessibility for Ontarians with Disabilities Act (AODA). Should you require Code-protected accommodation through any stage of the recruitment process, please notify us and we will work with you to meet your needs.

Company Overview:

CyberClan is a dynamic and rapidly growing organization committed to ensuring the security and integrity of our operations. We are seeking an experienced and proactive IT Security Manager to lead our security team and safeguard our assets, employees, and information.

Position Overview:

As the Security Operations Lead, you will be responsible for overseeing and managing all aspects of our security operations. This role requires a strategic thinker with a strong background in security management, risk assessment, and incident response. You will play a crucial role in developing and implementing security policies, procedures, and protocols to ensure the safety and security of our personnel, facilities, and information.

Principal Duties and Responsibilities:

• Ensuring clear strategies are in place for embedding operational security controls, aligned to relevant security policies and technical standards
• Manage a region of SOC analysts to deliver a 24x7x365 Security Operations Centre;
• Developing and improving processes to strengthen the current Security Operations;
• Ensure daily tasking, quality assessment, training and development is maintained for entire SOC region.
• Lead staff to proactively identify, prevent, and respond to security incidents;
• Ensuring incident identification, assessment, quantification, reporting, communication, mitigation, and monitoring;
• Producing and disseminating SOC management Information, including preparation of reporting material for Senior Management review;
• Provide clear, concise reporting around key KPI’s to their customers and internal teams.
• Manage 3rd Parties to ensure they deliver effective SOC services.
• Contribute to the design and development of defence and respond strategies, knowledgebase and playbooks.
• Support to design, build, manage and maintain security monitoring systems and infrastructure such as SIEM, IDS/IPS and cloud-based security platforms.
• Create and maintain compliance reports, supports the audit process, measures SOC performance metrics, and reports on security operations to Head of Security Operations and Director of GRC.
• Support the monitoring SIEM alerts effectively to minimize downtime and restore services.
• Responsible for managing and configuring security monitoring tools.
• Drive a learning and knowledge sharing security culture;
• Support the SOC team research global security events, issues and trends to produce security advisories for customers based on findings.

Generic Duties and Responsibilities:

• Ensuring an effective process of continuous improvement is in place
• Ensuring compliance with relevant security policies, standards, compliance and regulation
• Identifying requirements and driving improvements to SOC related policies and standards
• Inspire and motivate a team of SOC Analysts that can add value to our customers and support the internal teams.
• Accept, manage and update service requests and incidents to ensure contracted Service Level Agreements are met.
• Guiding, coaching and mentoring analysts who are providing the core SOC functions, including but not limited to, alert triage, incident escalation, content creation etc.
• Support Tier 2 Analysts
• Support sales knowledge base and weekly meetings to ensure up to date knowledge of services is maintained.
• Support customers for escalation purposes
• To continuously develop both technical and personal skills required within role and assist with development of other staff.
• Keep up to date on security developments and news
• Conducting cyber threat research and analysis for purposes of improving the strength of network security.
• Assist with defining, testing and operating new ways of working with new technology solutions or processes supplied to the SOC team.
• Proactively support business KPIs.
• Work with the CyberClan global team when responding to security incidents.
• Understand and comply with all Information Security policies.
• Understand and comply with all company policies.
• Follow agreed security best practices and SOC processes
• Interact with strategic incident response and threat intelligence vendors.
• To undertake other responsibilities, training and tasks as reasonably requested by line management.
• Undertake periodic assurance reviews and produce associated reporting as required.
• Participate in CyberClan internal security awareness initiatives and other training requests
• Other duties as assigned by the SOC Manager.

Qualifications:

• Educated to GCSE level or equivalent
• Cyber Security Qualification (CISSP, CCSP, Security+, AWS Security, GIAC certifications are an asset)
• EDR/XDR (Crowdstrike, SentinelOne, MS Defender, Trend Vison One)
• Networking experience, including IP addressing (VLAN, NAT, DNS, ACL)
• Linux, Sysmon, and FOSS
• ITIL Foundation

Skills, Knowledge and Experience:

• Knowledge and experience of SOC tooling to identify threats.
• Experience of collaboration tools
• Keen analytical mind and approach
• Proactively shares own expertise with others
• Knowledge and experience of IT systems, networking and security threat landscape including:
• Network fundamentals for example OSI stack, TCP/IP, DNS. HTTPS, firewall logs, packet capture and analysis.
• Cloud technologies (AWS, Google Cloud, Azure)
• Active Directory, Group Policies, PowerShell
• Endpoint protection applications (Antivirus, Web Filtering, ATP, Encryption)
• IDP/IPS Systems
• SIEM tools (such as Splunk)
• SOAR is an added advantage
• Knowledge of malware capabilities, attack vectors and impact.
• Knowledge of the MITRE ATT&CK framework to understand threat actors and how to mitigate them.
• Knowledge and experience in threat analysis.
• Training or educating network users about security protocols.
• Administration of network firewalls.
• Troubleshooting and problem-solving skills.
• Identification of security areas that can be improved, and the implementation of solutions to those areas.
• Dependability and flexibility, being on-call or available outside of regular work hours.
• Security Information and Event Management (SIEM).
• TCP/IP, computer networking, routing and switching.
• C, C++, C#, Java or PHP programming languages.
• IDS/IPS, penetration and vulnerability testing.
• Firewall and intrusion detection/prevention protocols.
• Windows, UNIX and Linux operating systems.
• Network protocols and packet analysis tools.
• Anti-virus and anti-malware.
• Various certifications including Security+, CEH, GIAC, CASP, CISSP.

Personal qualities:

• Confident with customer interactions, including face-to-face, web-ex and internal conversations.
• Excellent interpersonal skills sufficient to develop professional relationships and rapport amongst key stakeholders
• Strong team player
• Genuine enthusiasm and drive to work within cyber security.
• Excellent customer service skills
• Good written skills to write explanations of systems, regulations and or procedures.
• Good verbal communication
• Ability to identify and suggest continual improvement
• Good analytical and problem-solving skills
• Ability to adapt to organisational change
• Proven ability to manage varied workload
• Ability to work unsupervised and under pressure.
• Ability to effectively prioritize and execute tasks in a high-pressure environment
• A Self Starter with the ability to lead and drive change through an organisation.
• CEH, CISSP, PMP, GCIH, GSCE, or related certifications.
• Excellent communication and leadership skills.
• Knowledge on vendor management.
• Ability to handle high-pressure situations.
• Analytical and problem-solving skills.

Location

Remote

% of Travel Required

0-10%

Physical Requirements

Prolonged periods of sitting at a desk and working on a computer.

CyberClan is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.

• Seniority Level
• Mid-Senior level
• Industry
• Computer and Network Security
• Information Services
• Employment Type
• Full-time
• Job Functions
• Management
• Skills
• Security Operations
• Cyber Threat Hunting (CTH)
• Risk Assessment
• Incident Response
• Information Security
• Security Manage

Company Overview:

CyberClan is a dynamic and rapidly growing organization committed to ensuring the security and integrity of our operations. We are seeking an experienced and proactive IT Security Manager to lead our security team and safeguard our assets, employees, and information.

Position Overview:

As the Security Operations Lead, you will be responsible for overseeing and managing all aspects of our security operations. This role requires a strategic thinker with a strong background in security management, risk assessment, and incident response. You will play a crucial role in developing and implementing security policies, procedures, and protocols to ensure the safety and security of our personnel, facilities, and information.

Principal Duties and Responsibilities:

• Ensuring clear strategies are in place for embedding operational security controls, aligned to relevant security policies and technical standards
• Manage a region of SOC analysts to deliver a 24x7x365 Security Operations Centre;
• Developing and improving processes to strengthen the current Security Operations;
• Ensure daily tasking, quality assessment, training and development is maintained for entire SOC region.
• Lead staff to proactively identify, prevent, and respond to security incidents;
• Ensuring incident identification, assessment, quantification, reporting, communication, mitigation, and monitoring;
• Producing and disseminating SOC management Information, including preparation of reporting material for Senior Management review;
• Provide clear, concise reporting around key KPI’s to their customers and internal teams.
• Manage 3rd Parties to ensure they deliver effective SOC services.
• Contribute to the design and development of defence and respond strategies, knowledgebase and playbooks.
• Support to design, build, manage and maintain security monitoring systems and infrastructure such as SIEM, IDS/IPS and cloud-based security platforms.
• Create and maintain compliance reports, supports the audit process, measures SOC performance metrics, and reports on security operations to Head of Security Operations and Director of GRC.
• Support the monitoring SIEM alerts effectively to minimize downtime and restore services.
• Responsible for managing and configuring security monitoring tools.
• Drive a learning and knowledge sharing security culture;
• Support the SOC team research global security events, issues and trends to produce security advisories for customers based on findings.

Generic Duties and Responsibilities:

• Ensuring an effective process of continuous improvement is in place
• Ensuring compliance with relevant security policies, standards, compliance and regulation
• Identifying requirements and driving improvements to SOC related policies and standards
• Inspire and motivate a team of SOC Analysts that can add value to our customers and support the internal teams.
• Accept, manage and update service requests and incidents to ensure contracted Service Level Agreements are met.
• Guiding, coaching and mentoring analysts who are providing the core SOC functions, including but not limited to, alert triage, incident escalation, content creation etc.
• Support Tier 2 Analysts
• Support sales knowledge base and weekly meetings to ensure up to date knowledge of services is maintained.
• Support customers for escalation purposes
• To continuously develop both technical and personal skills required within role and assist with development of other staff.
• Keep up to date on security developments and news
• Conducting cyber threat research and analysis for purposes of improving the strength of network security.
• Assist with defining, testing and operating new ways of working with new technology solutions or processes supplied to the SOC team.
• Proactively support business KPIs.
• Work with the CyberClan global team when responding to security incidents.
• Understand and comply with all Information Security policies.
• Understand and comply with all company policies.
• Follow agreed security best practices and SOC processes
• Interact with strategic incident response and threat intelligence vendors.
• To undertake other responsibilities, training and tasks as reasonably requested by line management.
• Undertake periodic assurance reviews and produce associated reporting as required.
• Participate in CyberClan internal security awareness initiatives and other training requests
• Other duties as assigned by the SOC Manager.

Qualifications:

• Educated to GCSE level or equivalent
• Cyber Security Qualification (CISSP, CCSP, Security+, AWS Security, GIAC certifications are an asset)
• EDR/XDR (Crowdstrike, SentinelOne, MS Defender, Trend Vison One)
• Networking experience, including IP addressing (VLAN, NAT, DNS, ACL)
• Linux, Sysmon, and FOSS
• ITIL Foundation

Skills, Knowledge and Experience:

• Knowledge and experience of SOC tooling to identify threats.
• Experience of collaboration tools
• Keen analytical mind and approach
• Proactively shares own expertise with others
• Knowledge and experience of IT systems, networking and security threat landscape including:
• Network fundamentals for example OSI stack, TCP/IP, DNS. HTTPS, firewall logs, packet capture and analysis.
• Cloud technologies (AWS, Google Cloud, Azure)
• Active Directory, Group Policies, PowerShell
• Endpoint protection applications (Antivirus, Web Filtering, ATP, Encryption)
• IDP/IPS Systems
• SIEM tools (such as Splunk)
• SOAR is an added advantage
• Knowledge of malware capabilities, attack vectors and impact.
• Knowledge of the MITRE ATT&CK framework to understand threat actors and how to mitigate them.
• Knowledge and experience in threat analysis.
• Training or educating network users about security protocols.
• Administration of network firewalls.
• Troubleshooting and problem-solving skills.
• Identification of security areas that can be improved, and the implementation of solutions to those areas.
• Dependability and flexibility, being on-call or available outside of regular work hours.
• Security Information and Event Management (SIEM).
• TCP/IP, computer networking, routing and switching.
• C, C++, C#, Java or PHP programming languages.
• IDS/IPS, penetration and vulnerability testing.
• Firewall and intrusion detection/prevention protocols.
• Windows, UNIX and Linux operating systems.
• Network protocols and packet analysis tools.
• Anti-virus and anti-malware.
• Various certifications including Security+, CEH, GIAC, CASP, CISSP.

Personal qualities:

• Confident with customer interactions, including face-to-face, web-ex and internal conversations.
• Excellent interpersonal skills sufficient to develop professional relationships and rapport amongst key stakeholders
• Strong team player
• Genuine enthusiasm and drive to work within cyber security.
• Excellent customer service skills
• Good written skills to write explanations of systems, regulations and or procedures.
• Good verbal communication
• Ability to identify and suggest continual improvement
• Good analytical and problem-solving skills
• Ability to adapt to organisational change
• Proven ability to manage varied workload
• Ability to work unsupervised and under pressure.
• Ability to effectively prioritize and execute tasks in a high-pressure environment
• A Self Starter with the ability to lead and drive change through an organisation.
• CEH, CISSP, PMP, GCIH, GSCE, or related certifications.
• Excellent communication and leadership skills.
• Knowledge on vendor management.
• Ability to handle high-pressure situations.
• Analytical and problem-solving skills.

Location

Remote

% of Travel Required

0-10%

Physical Requirements

Prolonged periods of sitting at a desk and working on a computer.

CyberClan is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.

• Seniority Level
• Mid-Senior level
• Industry
• Computer and Network Security
• Information Services
• Employment Type
• Full-time
• Job Functions
• Management
• Skills
• Security Operations
• Cyber Threat Hunting (CTH)
• Risk Assessment
• Incident Response
• Information Security
• Security Manage

Company Overview:

CyberClan is a dynamic and rapidly growing organization committed to ensuring the security and integrity of our operations. We are seeking an experienced and proactive IT Security Manager to lead our security team and safeguard our assets, employees, and information.

Position Overview:

As the Security Operations Lead, you will be responsible for overseeing and managing all aspects of our security operations. This role requires a strategic thinker with a strong background in security management, risk assessment, and incident response. You will play a crucial role in developing and implementing security policies, procedures, and protocols to ensure the safety and security of our personnel, facilities, and information.

Principal Duties and Responsibilities:

• Ensuring clear strategies are in place for embedding operational security controls, aligned to relevant security policies and technical standards
• Manage a region of SOC analysts to deliver a 24x7x365 Security Operations Centre;
• Developing and improving processes to strengthen the current Security Operations;
• Ensure daily tasking, quality assessment, training and development is maintained for entire SOC region.
• Lead staff to proactively identify, prevent, and respond to security incidents;
• Ensuring incident identification, assessment, quantification, reporting, communication, mitigation, and monitoring;
• Producing and disseminating SOC management Information, including preparation of reporting material for Senior Management review;
• Provide clear, concise reporting around key KPI’s to their customers and internal teams.
• Manage 3rd Parties to ensure they deliver effective SOC services.
• Contribute to the design and development of defence and respond strategies, knowledgebase and playbooks.
• Support to design, build, manage and maintain security monitoring systems and infrastructure such as SIEM, IDS/IPS and cloud-based security platforms.
• Create and maintain compliance reports, supports the audit process, measures SOC performance metrics, and reports on security operations to Head of Security Operations and Director of GRC.
• Support the monitoring SIEM alerts effectively to minimize downtime and restore services.
• Responsible for managing and configuring security monitoring tools.
• Drive a learning and knowledge sharing security culture;
• Support the SOC team research global security events, issues and trends to produce security advisories for customers based on findings.

Generic Duties and Responsibilities:

• Ensuring an effective process of continuous improvement is in place
• Ensuring compliance with relevant security policies, standards, compliance and regulation
• Identifying requirements and driving improvements to SOC related policies and standards
• Inspire and motivate a team of SOC Analysts that can add value to our customers and support the internal teams.
• Accept, manage and update service requests and incidents to ensure contracted Service Level Agreements are met.
• Guiding, coaching and mentoring analysts who are providing the core SOC functions, including but not limited to, alert triage, incident escalation, content creation etc.
• Support Tier 2 Analysts
• Support sales knowledge base and weekly meetings to ensure up to date knowledge of services is maintained.
• Support customers for escalation purposes
• To continuously develop both technical and personal skills required within role and assist with development of other staff.
• Keep up to date on security developments and news
• Conducting cyber threat research and analysis for purposes of improving the strength of network security.
• Assist with defining, testing and operating new ways of working with new technology solutions or processes supplied to the SOC team.
• Proactively support business KPIs.
• Work with the CyberClan global team when responding to security incidents.
• Understand and comply with all Information Security policies.
• Understand and comply with all company policies.
• Follow agreed security best practices and SOC processes
• Interact with strategic incident response and threat intelligence vendors.
• To undertake other responsibilities, training and tasks as reasonably requested by line management.
• Undertake periodic assurance reviews and produce associated reporting as required.
• Participate in CyberClan internal security awareness initiatives and other training requests
• Other duties as assigned by the SOC Manager.

Qualifications:

• Educated to GCSE level or equivalent
• Cyber Security Qualification (CISSP, CCSP, Security+, AWS Security, GIAC certifications are an asset)
• EDR/XDR (Crowdstrike, SentinelOne, MS Defender, Trend Vison One)
• Networking experience, including IP addressing (VLAN, NAT, DNS, ACL)
• Linux, Sysmon, and FOSS
• ITIL Foundation

Skills, Knowledge and Experience:

• Knowledge and experience of SOC tooling to identify threats.
• Experience of collaboration tools
• Keen analytical mind and approach
• Proactively shares own expertise with others
• Knowledge and experience of IT systems, networking and security threat landscape including:
• Network fundamentals for example OSI stack, TCP/IP, DNS. HTTPS, firewall logs, packet capture and analysis.
• Cloud technologies (AWS, Google Cloud, Azure)
• Active Directory, Group Policies, PowerShell
• Endpoint protection applications (Antivirus, Web Filtering, ATP, Encryption)
• IDP/IPS Systems
• SIEM tools (such as Splunk)
• SOAR is an added advantage
• Knowledge of malware capabilities, attack vectors and impact.
• Knowledge of the MITRE ATT&CK framework to understand threat actors and how to mitigate them.
• Knowledge and experience in threat analysis.
• Training or educating network users about security protocols.
• Administration of network firewalls.
• Troubleshooting and problem-solving skills.
• Identification of security areas that can be improved, and the implementation of solutions to those areas.
• Dependability and flexibility, being on-call or available outside of regular work hours.
• Security Information and Event Management (SIEM).
• TCP/IP, computer networking, routing and switching.
• C, C++, C#, Java or PHP programming languages.
• IDS/IPS, penetration and vulnerability testing.
• Firewall and intrusion detection/prevention protocols.
• Windows, UNIX and Linux operating systems.
• Network protocols and packet analysis tools.
• Anti-virus and anti-malware.
• Various certifications including Security+, CEH, GIAC, CASP, CISSP.

Personal qualities:

• Confident with customer interactions, including face-to-face, web-ex and internal conversations.
• Excellent interpersonal skills sufficient to develop professional relationships and rapport amongst key stakeholders
• Strong team player
• Genuine enthusiasm and drive to work within cyber security.
• Excellent customer service skills
• Good written skills to write explanations of systems, regulations and or procedures.
• Good verbal communication
• Ability to identify and suggest continual improvement
• Good analytical and problem-solving skills
• Ability to adapt to organisational change
• Proven ability to manage varied workload
• Ability to work unsupervised and under pressure.
• Ability to effectively prioritize and execute tasks in a high-pressure environment
• A Self Starter with the ability to lead and drive change through an organisation.
• CEH, CISSP, PMP, GCIH, GSCE, or related certifications.
• Excellent communication and leadership skills.
• Knowledge on vendor management.
• Ability to handle high-pressure situations.
• Analytical and problem-solving skills.

Location

Remote

% of Travel Required

0-10%

Physical Requirements

Prolonged periods of sitting at a desk and working on a computer.

CyberClan is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.

• Seniority Level
• Mid-Senior level
• Industry
• Computer and Network Security
• Information Services
• Employment Type
• Full-time
• Job Functions
• Management
• Skills
• Security Operations
• Cyber Threat Hunting (CTH)
• Risk Assessment
• Incident Response
• Information Security
• Security Manage

Company Overview:

CyberClan is a dynamic and rapidly growing organization committed to ensuring the security and integrity of our operations. We are seeking an experienced and proactive IT Security Manager to lead our security team and safeguard our assets, employees, and information.

Position Overview:

As the Security Operations Lead, you will be responsible for overseeing and managing all aspects of our security operations. This role requires a strategic thinker with a strong background in security management, risk assessment, and incident response. You will play a crucial role in developing and implementing security policies, procedures, and protocols to ensure the safety and security of our personnel, facilities, and information.

Principal Duties and Responsibilities:

• Ensuring clear strategies are in place for embedding operational security controls, aligned to relevant security policies and technical standards
• Manage a region of SOC analysts to deliver a 24x7x365 Security Operations Centre;
• Developing and improving processes to strengthen the current Security Operations;
• Ensure daily tasking, quality assessment, training and development is maintained for entire SOC region.
• Lead staff to proactively identify, prevent, and respond to security incidents;
• Ensuring incident identification, assessment, quantification, reporting, communication, mitigation, and monitoring;
• Producing and disseminating SOC management Information, including preparation of reporting material for Senior Management review;
• Provide clear, concise reporting around key KPI’s to their customers and internal teams.
• Manage 3rd Parties to ensure they deliver effective SOC services.
• Contribute to the design and development of defence and respond strategies, knowledgebase and playbooks.
• Support to design, build, manage and maintain security monitoring systems and infrastructure such as SIEM, IDS/IPS and cloud-based security platforms.
• Create and maintain compliance reports, supports the audit process, measures SOC performance metrics, and reports on security operations to Head of Security Operations and Director of GRC.
• Support the monitoring SIEM alerts effectively to minimize downtime and restore services.
• Responsible for managing and configuring security monitoring tools.
• Drive a learning and knowledge sharing security culture;
• Support the SOC team research global security events, issues and trends to produce security advisories for customers based on findings.

Generic Duties and Responsibilities:

• Ensuring an effective process of continuous improvement is in place
• Ensuring compliance with relevant security policies, standards, compliance and regulation
• Identifying requirements and driving improvements to SOC related policies and standards
• Inspire and motivate a team of SOC Analysts that can add value to our customers and support the internal teams.
• Accept, manage and update service requests and incidents to ensure contracted Service Level Agreements are met.
• Guiding, coaching and mentoring analysts who are providing the core SOC functions, including but not limited to, alert triage, incident escalation, content creation etc.
• Support Tier 2 Analysts
• Support sales knowledge base and weekly meetings to ensure up to date knowledge of services is maintained.
• Support customers for escalation purposes
• To continuously develop both technical and personal skills required within role and assist with development of other staff.
• Keep up to date on security developments and news
• Conducting cyber threat research and analysis for purposes of improving the strength of network security.
• Assist with defining, testing and operating new ways of working with new technology solutions or processes supplied to the SOC team.
• Proactively support business KPIs.
• Work with the CyberClan global team when responding to security incidents.
• Understand and comply with all Information Security policies.
• Understand and comply with all company policies.
• Follow agreed security best practices and SOC processes
• Interact with strategic incident response and threat intelligence vendors.
• To undertake other responsibilities, training and tasks as reasonably requested by line management.
• Undertake periodic assurance reviews and produce associated reporting as required.
• Participate in CyberClan internal security awareness initiatives and other training requests
• Other duties as assigned by the SOC Manager.

Qualifications:

• Educated to GCSE level or equivalent
• Cyber Security Qualification (CISSP, CCSP, Security+, AWS Security, GIAC certifications are an asset)
• EDR/XDR (Crowdstrike, SentinelOne, MS Defender, Trend Vison One)
• Networking experience, including IP addressing (VLAN, NAT, DNS, ACL)
• Linux, Sysmon, and FOSS
• ITIL Foundation

Skills, Knowledge and Experience:

• Knowledge and experience of SOC tooling to identify threats.
• Experience of collaboration tools
• Keen analytical mind and approach
• Proactively shares own expertise with others
• Knowledge and experience of IT systems, networking and security threat landscape including:
• Network fundamentals for example OSI stack, TCP/IP, DNS. HTTPS, firewall logs, packet capture and analysis.
• Cloud technologies (AWS, Google Cloud, Azure)
• Active Directory, Group Policies, PowerShell
• Endpoint protection applications (Antivirus, Web Filtering, ATP, Encryption)
• IDP/IPS Systems
• SIEM tools (such as Splunk)
• SOAR is an added advantage
• Knowledge of malware capabilities, attack vectors and impact.
• Knowledge of the MITRE ATT&CK framework to understand threat actors and how to mitigate them.
• Knowledge and experience in threat analysis.
• Training or educating network users about security protocols.
• Administration of network firewalls.
• Troubleshooting and problem-solving skills.
• Identification of security areas that can be improved, and the implementation of solutions to those areas.
• Dependability and flexibility, being on-call or available outside of regular work hours.
• Security Information and Event Management (SIEM).
• TCP/IP, computer networking, routing and switching.
• C, C++, C#, Java or PHP programming languages.
• IDS/IPS, penetration and vulnerability testing.
• Firewall and intrusion detection/prevention protocols.
• Windows, UNIX and Linux operating systems.
• Network protocols and packet analysis tools.
• Anti-virus and anti-malware.
• Various certifications including Security+, CEH, GIAC, CASP, CISSP.

Personal qualities:

• Confident with customer interactions, including face-to-face, web-ex and internal conversations.
• Excellent interpersonal skills sufficient to develop professional relationships and rapport amongst key stakeholders
• Strong team player
• Genuine enthusiasm and drive to work within cyber security.
• Excellent customer service skills
• Good written skills to write explanations of systems, regulations and or procedures.
• Good verbal communication
• Ability to identify and suggest continual improvement
• Good analytical and problem-solving skills
• Ability to adapt to organisational change
• Proven ability to manage varied workload
• Ability to work unsupervised and under pressure.
• Ability to effectively prioritize and execute tasks in a high-pressure environment
• A Self Starter with the ability to lead and drive change through an organisation.
• CEH, CISSP, PMP, GCIH, GSCE, or related certifications.
• Excellent communication and leadership skills.
• Knowledge on vendor management.
• Ability to handle high-pressure situations.
• Analytical and problem-solving skills.

Location

Remote

% of Travel Required

0-10%

Physical Requirements

Prolonged periods of sitting at a desk and working on a computer.

CyberClan is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.

• Seniority Level
• Mid-Senior level
• Industry
• Computer and Network Security
• Information Services
• Employment Type
• Full-time
• Job Functions
• Management
• Skills
• Security Operations
• Cyber Threat Hunting (CTH)
• Risk Assessment
• Incident Response
• Information Security
• Security Manage

Company Overview:

CyberClan is a dynamic and rapidly growing organization committed to ensuring the security and integrity of our operations. We are seeking an experienced and proactive IT Security Manager to lead our security team and safeguard our assets, employees, and information.

Position Overview:

As the Security Operations Lead, you will be responsible for overseeing and managing all aspects of our security operations. This role requires a strategic thinker with a strong background in security management, risk assessment, and incident response. You will play a crucial role in developing and implementing security policies, procedures, and protocols to ensure the safety and security of our personnel, facilities, and information.

Principal Duties and Responsibilities:

• Ensuring clear strategies are in place for embedding operational security controls, aligned to relevant security policies and technical standards
• Manage a region of SOC analysts to deliver a 24x7x365 Security Operations Centre;
• Developing and improving processes to strengthen the current Security Operations;
• Ensure daily tasking, quality assessment, training and development is maintained for entire SOC region.
• Lead staff to proactively identify, prevent, and respond to security incidents;
• Ensuring incident identification, assessment, quantification, reporting, communication, mitigation, and monitoring;
• Producing and disseminating SOC management Information, including preparation of reporting material for Senior Management review;
• Provide clear, concise reporting around key KPI’s to their customers and internal teams.
• Manage 3rd Parties to ensure they deliver effective SOC services.
• Contribute to the design and development of defence and respond strategies, knowledgebase and playbooks.
• Support to design, build, manage and maintain security monitoring systems and infrastructure such as SIEM, IDS/IPS and cloud-based security platforms.
• Create and maintain compliance reports, supports the audit process, measures SOC performance metrics, and reports on security operations to Head of Security Operations and Director of GRC.
• Support the monitoring SIEM alerts effectively to minimize downtime and restore services.
• Responsible for managing and configuring security monitoring tools.
• Drive a learning and knowledge sharing security culture;
• Support the SOC team research global security events, issues and trends to produce security advisories for customers based on findings.

Generic Duties and Responsibilities:

• Ensuring an effective process of continuous improvement is in place
• Ensuring compliance with relevant security policies, standards, compliance and regulation
• Identifying requirements and driving improvements to SOC related policies and standards
• Inspire and motivate a team of SOC Analysts that can add value to our customers and support the internal teams.
• Accept, manage and update service requests and incidents to ensure contracted Service Level Agreements are met.
• Guiding, coaching and mentoring analysts who are providing the core SOC functions, including but not limited to, alert triage, incident escalation, content creation etc.
• Support Tier 2 Analysts
• Support sales knowledge base and weekly meetings to ensure up to date knowledge of services is maintained.
• Support customers for escalation purposes
• To continuously develop both technical and personal skills required within role and assist with development of other staff.
• Keep up to date on security developments and news
• Conducting cyber threat research and analysis for purposes of improving the strength of network security.
• Assist with defining, testing and operating new ways of working with new technology solutions or processes supplied to the SOC team.
• Proactively support business KPIs.
• Work with the CyberClan global team when responding to security incidents.
• Understand and comply with all Information Security policies.
• Understand and comply with all company policies.
• Follow agreed security best practices and SOC processes
• Interact with strategic incident response and threat intelligence vendors.
• To undertake other responsibilities, training and tasks as reasonably requested by line management.
• Undertake periodic assurance reviews and produce associated reporting as required.
• Participate in CyberClan internal security awareness initiatives and other training requests
• Other duties as assigned by the SOC Manager.

Qualifications:

• Educated to GCSE level or equivalent
• Cyber Security Qualification (CISSP, CCSP, Security+, AWS Security, GIAC certifications are an asset)
• EDR/XDR (Crowdstrike, SentinelOne, MS Defender, Trend Vison One)
• Networking experience, including IP addressing (VLAN, NAT, DNS, ACL)
• Linux, Sysmon, and FOSS
• ITIL Foundation

Skills, Knowledge and Experience:

• Knowledge and experience of SOC tooling to identify threats.
• Experience of collaboration tools
• Keen analytical mind and approach
• Proactively shares own expertise with others
• Knowledge and experience of IT systems, networking and security threat landscape including:
• Network fundamentals for example OSI stack, TCP/IP, DNS. HTTPS, firewall logs, packet capture and analysis.
• Cloud technologies (AWS, Google Cloud, Azure)
• Active Directory, Group Policies, PowerShell
• Endpoint protection applications (Antivirus, Web Filtering, ATP, Encryption)
• IDP/IPS Systems
• SIEM tools (such as Splunk)
• SOAR is an added advantage
• Knowledge of malware capabilities, attack vectors and impact.
• Knowledge of the MITRE ATT&CK framework to understand threat actors and how to mitigate them.
• Knowledge and experience in threat analysis.
• Training or educating network users about security protocols.
• Administration of network firewalls.
• Troubleshooting and problem-solving skills.
• Identification of security areas that can be improved, and the implementation of solutions to those areas.
• Dependability and flexibility, being on-call or available outside of regular work hours.
• Security Information and Event Management (SIEM).
• TCP/IP, computer networking, routing and switching.
• C, C++, C#, Java or PHP programming languages.
• IDS/IPS, penetration and vulnerability testing.
• Firewall and intrusion detection/prevention protocols.
• Windows, UNIX and Linux operating systems.
• Network protocols and packet analysis tools.
• Anti-virus and anti-malware.
• Various certifications including Security+, CEH, GIAC, CASP, CISSP.

Personal qualities:

• Confident with customer interactions, including face-to-face, web-ex and internal conversations.
• Excellent interpersonal skills sufficient to develop professional relationships and rapport amongst key stakeholders
• Strong team player
• Genuine enthusiasm and drive to work within cyber security.
• Excellent customer service skills
• Good written skills to write explanations of systems, regulations and or procedures.
• Good verbal communication
• Ability to identify and suggest continual improvement
• Good analytical and problem-solving skills
• Ability to adapt to organisational change
• Proven ability to manage varied workload
• Ability to work unsupervised and under pressure.
• Ability to effectively prioritize and execute tasks in a high-pressure environment
• A Self Starter with the ability to lead and drive change through an organisation.
• CEH, CISSP, PMP, GCIH, GSCE, or related certifications.
• Excellent communication and leadership skills.
• Knowledge on vendor management.
• Ability to handle high-pressure situations.
• Analytical and problem-solving skills.

Location

Remote

% of Travel Required

0-10%

Physical Requirements

Prolonged periods of sitting at a desk and working on a computer.

CyberClan is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.

• Seniority Level
• Mid-Senior level
• Industry
• Computer and Network Security
• Information Services
• Employment Type
• Full-time
• Job Functions
• Management
• Skills
• Security Operations
• Cyber Threat Hunting (CTH)
• Risk Assessment
• Incident Response
• Information Security
• Security Manage

Company Overview:

CyberClan is a dynamic and rapidly growing organization committed to ensuring the security and integrity of our operations. We are seeking an experienced and proactive IT Security Manager to lead our security team and safeguard our assets, employees, and information.

Position Overview:

As the Security Operations Lead, you will be responsible for overseeing and managing all aspects of our security operations. This role requires a strategic thinker with a strong background in security management, risk assessment, and incident response. You will play a crucial role in developing and implementing security policies, procedures, and protocols to ensure the safety and security of our personnel, facilities, and information.

Principal Duties and Responsibilities:

• Ensuring clear strategies are in place for embedding operational security controls, aligned to relevant security policies and technical standards
• Manage a region of SOC analysts to deliver a 24x7x365 Security Operations Centre;
• Developing and improving processes to strengthen the current Security Operations;
• Ensure daily tasking, quality assessment, training and development is maintained for entire SOC region.
• Lead staff to proactively identify, prevent, and respond to security incidents;
• Ensuring incident identification, assessment, quantification, reporting, communication, mitigation, and monitoring;
• Producing and disseminating SOC management Information, including preparation of reporting material for Senior Management review;
• Provide clear, concise reporting around key KPI’s to their customers and internal teams.
• Manage 3rd Parties to ensure they deliver effective SOC services.
• Contribute to the design and development of defence and respond strategies, knowledgebase and playbooks.
• Support to design, build, manage and maintain security monitoring systems and infrastructure such as SIEM, IDS/IPS and cloud-based security platforms.
• Create and maintain compliance reports, supports the audit process, measures SOC performance metrics, and reports on security operations to Head of Security Operations and Director of GRC.
• Support the monitoring SIEM alerts effectively to minimize downtime and restore services.
• Responsible for managing and configuring security monitoring tools.
• Drive a learning and knowledge sharing security culture;
• Support the SOC team research global security events, issues and trends to produce security advisories for customers based on findings.

Generic Duties and Responsibilities:

• Ensuring an effective process of continuous improvement is in place
• Ensuring compliance with relevant security policies, standards, compliance and regulation
• Identifying requirements and driving improvements to SOC related policies and standards
• Inspire and motivate a team of SOC Analysts that can add value to our customers and support the internal teams.
• Accept, manage and update service requests and incidents to ensure contracted Service Level Agreements are met.
• Guiding, coaching and mentoring analysts who are providing the core SOC functions, including but not limited to, alert triage, incident escalation, content creation etc.
• Support Tier 2 Analysts
• Support sales knowledge base and weekly meetings to ensure up to date knowledge of services is maintained.
• Support customers for escalation purposes
• To continuously develop both technical and personal skills required within role and assist with development of other staff.
• Keep up to date on security developments and news
• Conducting cyber threat research and analysis for purposes of improving the strength of network security.
• Assist with defining, testing and operating new ways of working with new technology solutions or processes supplied to the SOC team.
• Proactively support business KPIs.
• Work with the CyberClan global team when responding to security incidents.
• Understand and comply with all Information Security policies.
• Understand and comply with all company policies.
• Follow agreed security best practices and SOC processes
• Interact with strategic incident response and threat intelligence vendors.
• To undertake other responsibilities, training and tasks as reasonably requested by line management.
• Undertake periodic assurance reviews and produce associated reporting as required.
• Participate in CyberClan internal security awareness initiatives and other training requests
• Other duties as assigned by the SOC Manager.

Qualifications:

• Educated to GCSE level or equivalent
• Cyber Security Qualification (CISSP, CCSP, Security+, AWS Security, GIAC certifications are an asset)
• EDR/XDR (Crowdstrike, SentinelOne, MS Defender, Trend Vison One)
• Networking experience, including IP addressing (VLAN, NAT, DNS, ACL)
• Linux, Sysmon, and FOSS
• ITIL Foundation

Skills, Knowledge and Experience:

• Knowledge and experience of SOC tooling to identify threats.
• Experience of collaboration tools
• Keen analytical mind and approach
• Proactively shares own expertise with others
• Knowledge and experience of IT systems, networking and security threat landscape including:
• Network fundamentals for example OSI stack, TCP/IP, DNS. HTTPS, firewall logs, packet capture and analysis.
• Cloud technologies (AWS, Google Cloud, Azure)
• Active Directory, Group Policies, PowerShell
• Endpoint protection applications (Antivirus, Web Filtering, ATP, Encryption)
• IDP/IPS Systems
• SIEM tools (such as Splunk)
• SOAR is an added advantage
• Knowledge of malware capabilities, attack vectors and impact.
• Knowledge of the MITRE ATT&CK framework to understand threat actors and how to mitigate them.
• Knowledge and experience in threat analysis.
• Training or educating network users about security protocols.
• Administration of network firewalls.
• Troubleshooting and problem-solving skills.
• Identification of security areas that can be improved, and the implementation of solutions to those areas.
• Dependability and flexibility, being on-call or available outside of regular work hours.
• Security Information and Event Management (SIEM).
• TCP/IP, computer networking, routing and switching.
• C, C++, C#, Java or PHP programming languages.
• IDS/IPS, penetration and vulnerability testing.
• Firewall and intrusion detection/prevention protocols.
• Windows, UNIX and Linux operating systems.
• Network protocols and packet analysis tools.
• Anti-virus and anti-malware.
• Various certifications including Security+, CEH, GIAC, CASP, CISSP.

Personal qualities:

• Confident with customer interactions, including face-to-face, web-ex and internal conversations.
• Excellent interpersonal skills sufficient to develop professional relationships and rapport amongst key stakeholders
• Strong team player
• Genuine enthusiasm and drive to work within cyber security.
• Excellent customer service skills
• Good written skills to write explanations of systems, regulations and or procedures.
• Good verbal communication
• Ability to identify and suggest continual improvement
• Good analytical and problem-solving skills
• Ability to adapt to organisational change
• Proven ability to manage varied workload
• Ability to work unsupervised and under pressure.
• Ability to effectively prioritize and execute tasks in a high-pressure environment
• A Self Starter with the ability to lead and drive change through an organisation.
• CEH, CISSP, PMP, GCIH, GSCE, or related certifications.
• Excellent communication and leadership skills.
• Knowledge on vendor management.
• Ability to handle high-pressure situations.
• Analytical and problem-solving skills.

Location

Remote

% of Travel Required

0-10%

Physical Requirements

Prolonged periods of sitting at a desk and working on a computer.

CyberClan is an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.

• Seniority Level
• Mid-Senior level
• Industry
• Computer and Network Security
• Information Services
• Employment Type
• Full-time
• Job Functions
• Management
• Skills
• Security Operations
• Cyber Threat Hunting (CTH)
• Risk Assessment
• Incident Response
• Information Security
• Security Manage