SOC Analyst, Tier III

Who You Will Work With:

The SOC Analyst, Tier III role will report to the Leader, Security Incident Management.

What You Will Do:

Incident Response & Security Investigations

• Lead the investigation, containment, eradication, and recovery of complex cybersecurity incidents, including malware, insider threats, unauthorized access, and advanced cyberattacks.

• Conduct advanced threat analysis, forensic investigations, and root cause assessments to identify attack vectors and business impacts.

• Act as the senior escalation point for critical security incidents, coordinating response activities across technical teams, business stakeholders, and external partners.

• Develop incident response strategies, playbooks, and lessons learned to strengthen organizational resilience.

• Prepare post-incident reports, recommendations, and remediation plans.

Digital Forensics & Evidence Management

• Perform digital forensic investigations across endpoints, servers, cloud environments, and network infrastructure.

• Collect, preserve, analyse, and document digital evidence in accordance with forensic and chain-of-custody standards.

• Produce forensic reports to support remediation efforts, compliance requirements, audits, and legal or regulatory investigations.

• Apply advanced forensic tools and methodologies to investigate sophisticated cyber threats.

Threat Hunting & Cyber Defence ​

• Lead proactive threat hunting initiatives to identify, investigate, and mitigate emerging and hidden threats.

• Develop and enhance security monitoring capabilities, detection use cases, and threat analytics.

• Leverage threat intelligence to anticipate evolving threats and strengthen defensive strategies.

• Drive continuous improvements to reduce cyber risk and improve threat visibility across the enterprise.

Cybersecurity Strategy & Collaboration

• Contribute to the development and enhancement of cybersecurity policies, standards, and incident response frameworks.

• Provide expert cybersecurity guidance to technology, risk, legal, compliance, and business teams.

• Partner with internal and external stakeholders to support audits, regulatory assessments, security awareness initiatives, and operational resilience efforts.

• Monitor emerging threats, trends, and technologies to inform strategic security improvements.

What You Bring:

• Extensive experience in cybersecurity incident response, digital forensics, threat hunting, and cyber threat intelligence.

• Deep understanding of offensive and defensive security techniques, attack methodologies, and threat actor tactics.

• Advanced expertise in malware analysis, memory forensics, host-based forensics, network forensics, and incident reconstruction in both on prem and cloud environments.

• Experience conducting complex digital forensic investigations across Windows, Linux, macOS, cloud, and enterprise environments.

• Strong knowledge of security monitoring, SIEM (Sentinel, Splunk, LogRythm, QRadar), endpoint detection and response (EDR) (Defender for Endpoint, Cortex, Crowdstrike), intrusion detection/prevention systems (IDS/IPS), and vulnerability management technologies.

• Experience in onboarding log sources and threat detection engineering (use case development and rule tuning).

• Strong understanding of networking concepts, TCP/IP, operating systems, application security, and infrastructure security controls.

• Experience leading incidents from minor to major in nature.

• Demonstrated ability to lead complex investigations, manage competing priorities, and coordinate cross-functional response efforts.

• Exceptional analytical, problem-solving, and troubleshooting capabilities with strong attention to detail.

• Strong written and verbal communication skills, with the ability to translate complex technical findings for technical and non-technical audiences.

• Proven ability to work independently, exercise sound judgement, and drive continuous improvement initiatives.

• Professional certifications such as GIAC, GCFA, GCIH, CISSP, CISA, or equivalent are considered an asset.

• Experience working within ISO-certified environments and familiarity with ITIL practices are considered assets.

• Willingness to participate in an after-hours on-call rotation to support critical incident response activities.

• Eligibility to work for Interac Corp. in Canada in a full-time capacity.

What We’re Offering: