SOC Analyst (Night Shift)

As a Security Operations Centre (SOC) Analyst - Nights, you will serve as a first responder to security incidents and are integral in preventing, detecting, and responding to cyber threats and attacks on ATCO’s network and systems. Working independently overnight, you will collaborate with ATCO security teams and business units to protect the confidentiality, integrity, and availability of the organization’s digital assets and services. You will also document findings and actions and provide clear shift handovers, ensuring emerging threats receive continuous attention.

•    Continuously monitor security alerts and events from various sources such as SIEM (Security Information and Event Management) systems, IDS/IPS (Intrusion Detection/Prevention Systems), firewalls, Endpoint Protection and other security tools
•    Investigate and respond to security incidents, including malware infections, phishing attacks, and unauthorized access attempts
•    Analyze and assess potential threats, vulnerabilities, and risks to the organization's information systems
•    Conduct threat hunts during incidents to search for signs of malicious activity or potential threats within the network
•    Participate in shift handovers to ensure continuity of monitoring efforts
•    Recommend rule and detection improvements to reduce false positives and strengthen threat-detection capabilities.
•    Provide feedback on quality of log events and identify potential gaps in existing logging
•    Document and report security incidents, findings, and actions taken to relevant stakeholders
•    Work closely with other ATCO security teams and business units to ensure a coordinated response to security incidents and to improve overall security posture.  
•    Participate in post-incident reviews and contribute to the development and implementation of security policies, procedures, and best practices
•    Share knowledge, exchange lessons learned, and support continuous learning across the SOC

•    Post-secondary education in Cybersecurity, Information Technology, or related field 
•    3+ years cybersecurity experience in a Security Operations Centre (SOC) or similar security monitoring environment
•    Knowledge of common attack techniques, tactics, and vectors, including phishing, distributed denial-of-service attacks, and malware, with familiarity with frameworks such as MITRE ATT&CK
•    Experience investigating and assessing attack activity within a security monitoring environment
•    Solid understanding of networking, operating systems (Linux/Windows), and security principles
•    Experience with incident detection, escalation, and response
•    Proficiency with SIEM tools (e.g., Splunk, ArcSight, Sentinel, or similar platforms)
•    Familiarity with firewalls, intrusion detection and prevention systems (IDS/IPS), endpoint protection, and related security technologies
•    Sound analytical judgment and close attention to detail when assessing security events and incidents
•    Clear written and verbal communication skills, including experience explaining technical issues and incident findings to technical and non-technical stakeholders
•    Experience preparing clear, accurate incident records that document findings, decisions, and response actions.
•    Independent judgment, effective prioritization, and composure in high-pressure situations
•    Ability to work scheduled night shifts in a 24/7 environment, including weekends and holidays
•    Previous experience working night shifts or operating independently is an asset.