Security Operations Analyst

Get roles like this by email

New roles in Waterloo Region, mailed the morning after they appear, and The Weekly each Monday.

Change or stop it from any email.

We are the leading provider of professional services to the middle market globally, our purpose is to instill confidence in a world of change, empowering our clients and people to realize their full potential. Our exceptional people are the key to our unrivaled, inclusive culture and talent experience and our ability to be compelling to our clients. You’ll find an environment that inspires and empowers you to thrive both personally and professionally. There’s no one like you and that’s why there’s nowhere like RSM.

The Security Operations Analyst is responsible for detecting, investigating, and responding to cybersecurity threats and incidents across the organization’s systems, networks, cloud environments, and applications. This role helps protect enterprise assets by monitoring security controls, leading incident investigations, coordinating response activities, and driving continuous improvement of threat and vulnerability management programs.

The analyst applies structured analytical techniques to assess risk, identify emerging threats, and provide actionable recommendations to Information Technology and business leadership. The role also contributes to broader Information Security initiatives, including security architecture reviews, standards development, security automation, and operational maturity improvements.

Key Responsibilities

Security Monitoring and Incident Response

• Monitor security events and alerts across enterprise technologies to identify malicious activity, security incidents, and control failures.

• Investigate cybersecurity events and incidents, including malware infections, account compromise, insider threats, phishing attacks, unauthorized access attempts, and data security concerns.

• Coordinate and facilitate incident response activities across technical and business teams.

• Execute containment, eradication, and recovery activities during security incidents.

• Perform root cause analysis and document lessons learned following incident resolution.

• Maintain incident documentation, evidence collection, and reporting in accordance with organizational standards.

Threat Detection and Threat Management

• Monitor for attempts to circumvent security controls by internal users, third parties, and external threat actors.

• Conduct threat hunting activities using available telemetry, logs, and threat intelligence.

• Manage and improve security detection capabilities within SIEM, EDR, and related security technologies.

• Analyze threat intelligence and translate findings into actionable security improvements.

• Maintain blacklist, watchlist, and detection management processes.

Vulnerability Management

• Execute and continuously improve vulnerability management processes across infrastructure, applications, cloud environments, and emerging technologies.

• Coordinate vulnerability assessments, penetration testing, secure code reviews, red team exercises, and remediation efforts.

• Evaluate vulnerabilities for business risk and prioritize remediation activities.

• Track remediation progress and communicate risk exposure to leadership and stakeholders.

Security Operations and Continuous Improvement

• Analyze, evaluate, and test the effectiveness of existing security controls.

• Assess security processes and identify opportunities for operational improvement and increased efficiency.

• Apply structured analytical methodologies to incident investigations, threat analysis, and process optimization efforts.

• Develop operational metrics, reporting, and dashboards to support risk-informed decision-making.

• Support audit, compliance, and regulatory initiatives as required.

Security Strategy and Collaboration

• Communicate security risks, control effectiveness, and incident trends to Information Technology leadership and business stakeholders.

• Support security architecture reviews, technology evaluations, and project security assessments.

• Contribute to the development and maintenance of security standards, policies, procedures, and playbooks.

• Partner with infrastructure, cloud, application development, and business teams to strengthen the organization’s overall security posture.

Required Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field, or an equivalent combination of education and experience.

• Five or more years of experience in cybersecurity, security operations, incident response, or threat management.

• Experience coordinating multidisciplinary teams during cybersecurity incidents.

• Strong understanding of security principles across operating systems, applications, networking, cloud platforms, mobile technologies, endpoint security, and identity and access management.

• Experience with SIEM, EDR/XDR, vulnerability management, and security monitoring technologies.

• Strong analytical, communication, and problem-solving skills.

• Ability to perform effectively under pressure and manage multiple priorities simultaneously.

Preferred Qualifications

• Industry certifications such as CISSP, GCIH, GCFA, CISA, CEH, OSCP, or Security+.

• Master’s degree in Cybersecurity, Information Security, Computer Science, or related discipline.

• Experience managing or responding to significant cybersecurity incidents and enterprise-scale investigations.

• Experience with business intelligence, reporting, and data analytics tools.

• Experience with Python, PowerShell, or other automation and orchestration technologies.

• Experience designing or supporting Security Orchestration, Automation, and Response (SOAR) solutions.

• Knowledge of threat intelligence, digital forensics, cloud-native security, and modern detection engineering practices.

• Experience applying artificial intelligence, machine learning, or neural network technologies to cybersecurity operations.

At RSM, we offer a competitive benefits and compensation package for all…