Security Operations Specialist

Role: Security Operations Specialist

Type: Hybrid [Mandatory]

Location: Kanata, ON [Ottawa, ON]

Security Clearance: Must be eligible for up to a Top-Secret Security Clearance

Salary: CAD 110,000 – 120,000/-

Job Overview

We are seeking a highly organized Security Operations Specialist to oversee day-to-day operational security across endpoints, identity, networks, and cloud services. As a key member of the Trust & Security group, you will own detection and response workflows and drive the continuous improvement of controls protecting our people and information assets. You will leverage your experience and judgment to triage incidents, drive remediation, and mature our organization toward a scalable, zero-trust approach in a hybrid environment.

Key Responsibilities

• Own the full incident lifecycle, including intake, severity classification, escalation, containment, and post-incident reviews.
• Monitor security signals across AWS, identity providers, and networks; investigate alerts and drive them to resolution.
• Maintain accurate runbooks, conduct tabletop exercises, and work to reduce mean-time-to-detect (MTTD) and respond (MTTR).
• Leverage tools like CrowdStrike Falcon and NG-SIEM to tune alerts, build response playbooks, and reduce operational noise.
• Support ISO-27001, UK Cyber Essentials, and NIST 800-53 by providing operational evidence and improving control effectiveness.
• Partner with Legal, Finance, and IT on vendor security reviews, risk notes, and third-party access governance.
• Assist in the transition to a zero-trust architecture through identity-first controls, device trust, and least privilege.
• Participate in a rotation to support incident response and operational security needs outside of regular business hours.

Qualifications

• 8+ years of experience maturing Security Operations from ad hoc alert handling into a reliable, measurable response capability.
• Technical hands-on experience with CrowdStrike Falcon, AWS GuardDuty, and intrusion prevention tools like Intrusion Shield.
• Ability to maintain clean operational workflows using ManageEngine for incident and problem tracking.
• Calm and structured under pressure, with the ability to lead investigations that result in long-term fixes.
• A constant learner who prioritizes automation and can balance high security with business velocity.
• Ability to explain complex security risks clearly to both technical and non-technical stakeholders.