Security Operations Analyst II

About AlphaSense:

AlphaSense is the AI platform redefining market intelligence and workflow orchestration, trusted by thousands of leading organizations to drive faster, more confident decisions in business and finance. The platform combines domain-specific AI with a vast content universe of over 500 million premium business documents — including equity research, earnings calls, expert interviews, filings, news, and internal proprietary content. Purpose-built for speed, accuracy, and enterprise-grade security, AlphaSense helps teams extract critical insights, uncover market-moving trends, and automate complex workflows with high-quality outputs. With AI solutions like Generative Search, Generative Grid, and Deep Research, AlphaSense delivers the clarity and depth professionals need to navigate complexity and obtain accurate, real-time information quickly. For more information, visit www.alpha-sense.com. Come join us.

Remote within Canada, able to work in the Pacific time zone

ABOUT THE ROLE

We are hiring Security Operations Analyst II to join our Security Operations team in a fully remote capacity from Canada. This role sits at Tier 1–2 in our operating model — you are past the stage of learning what alerts look like and ready to own triage, perform structured investigations, and contribute to detection quality. You will handle the day-to-day alert queue, investigate escalated or ambiguous cases, handle incidents and work closely with senior analysts and the Security Operations Manager to close coverage gaps.

We expect you to think analytically, document thoroughly, and operate with growing independence. You will be supported by experienced colleagues and a mature toolset, but you are expected to bring real investigative instinct and a curiosity to grow to the role from day one.

WHAT YOU WILL DO

Alert Triage & Investigation

Monitor and triage alerts across endpoint, network, cloud, runtime and identity data sources with accuracy and appropriate urgency

Perform structured investigations on escalated or ambiguous alerts: pivot across log sources, correlate events, and build a coherent timeline

Classify alerts correctly — true positive, false positive, or benign — with documented rationale, not just a verdict

Identify scope and blast radius on confirmed incidents: affected users, systems, and data before escalating or containing

Escalate to senior analysts with a complete investigation package — context, evidence, timeline, and a hypothesis

Incident Response Support

Participate in active incident response under senior analyst or manager direction: evidence collection, log pulls, timeline reconstruction

Execute containment actions — endpoint isolation, account suspension, token revocation — as directed with documented rationale

Maintain accurate and timely case documentation throughout the incident lifecycle

Contribute to post-incident timelines and assist with root cause documentation

Cloud & Identity Security Monitoring

Monitor cloud audit logs and native threat detection findings for suspicious IAM activity, unusual API calls, and access anomalies

Investigate identity provider events: suspicious logins, MFA bypass attempts, session anomalies, and unauthorized app assignments

Recognize common cloud-native attack patterns: credential abuse via metadata service, privilege escalation via IAM role assumption, and storage misconfiguration access

Correlate cloud-side events with endpoint and network telemetry to build a fuller picture of attacker activity

Detection & Quality Improvement

Flag false positives and noisy detections with enough context for a senior analyst or detection engineer to tune them

Identify gaps in existing detection coverage based on alert patterns you observe during triage

Apply knowledge of MITRE ATT&CK to label attacker techniques and communicate findings consistently

Contribute to runbook accuracy by flagging outdated steps or missing guidance encountered during investigations

Participate with Detections Engineers to build detections and contribute to automating activity with an Engineering mindset

Documentation & Communication

Write clear, concise case notes that a colleague could pick up mid-investigation without needing to re-investigate from scratch

Produce shift handoff summaries that accurately represent open cases, pending actions, and investigation status

Communicate incident updates to the Security Operations Manager with sufficient clarity to brief upward without re-investigation

WHAT WE ARE LOOKING FOR

Required

2–4+ years of hands-on experience in a SOC, or security operations role with direct alert triage responsibility

Solid understanding of the MITRE ATT&CK framework — you use it to label and communicate attacker behavior, not just reference it

Working knowledge of EDR tooling: process tree analysis, behavioral detection review, and basic endpoint artifact interpretation

Familiarity with SIEM-based investigation: querying logs, correlating events across sources, and building timelines from normalized data

Understanding of foundational network protocols (TCP/IP, DNS, HTTP/S, TLS) and how attackers abuse them

Exposure to cloud security monitoring ex. AWS or GCP — including audit log review and IAM-related alert investigation

Experience investigating identity-based alerts in an enterprise identity provider (e.g., Okta, Entra ID, or equivalent)

Strong written communication: your case notes are accurate, structured, and useful to someone who wasn’t there

Preferred

Experience with next-gen EDR platforms (e.g., CrowdStrike Falcon, SentinelOne, or equivalent) beyond basic alert review — RTR, process trees, custom detections

Hands-on SIEM experience with a cloud-native platform (e.g., Google SecOps/Chronicle, Microsoft Sentinel, or equivalent)

Exposure to CSPM or cloud security tooling (e.g., Wiz, Prisma Cloud, or equivalent) as an investigation data source

Familiarity with AWS IR fundamentals: CloudTrail, GuardDuty, VPC Flow Logs, IAM chain analysis

Understanding of encoding vs. encryption vs. hashing and their relevance to attacker obfuscation techniques

Experience working alongside or receiving escalations from a managed detection and response (MDR) partner

Relevant certifications: CompTIA CySA+, Security+, BTL1, GCIH, or equivalent practical security credential

For base compensation, we set standard ranges for all roles based on function and level benchmarked against similar stage growth companies and internal comparables. In order to be compliant with local legislation, as well as to provide greater transparency to candidates, we share salary ranges on all job postings regardless of desired hiring location. Final offer amounts are determined by multiple factors including candidate experience/expertise and may vary from the amounts listed below.

You may also be offered a performance-based bonus, equity, and a generous benefits program.

Base Compensation Range$65,000—$90,000 CAD

AlphaSense is an equal-opportunity employer. We are committed to a work environment that supports, inspires, and respects all individuals. All employees share in the responsibility for fulfilling AlphaSense’s commitment to equal employment opportunity. AlphaSense does not discriminate against any employee or applicant on the basis of race, color, sex (including pregnancy), national origin, age, religion, marital status, sexual orientation, gender identity, gender expression, military or veteran status, disability, or any other non-merit factor. This policy applies to every aspect of employment at AlphaSense, including recruitment, hiring, training, advancement, and termination.

In addition, it is the policy of AlphaSense to provide reasonable accommodation to qualified employees who have protected disabilities to the extent required by applicable laws, regulations, and ordinances where a particular employee works.

Recruiting Scams and Fraud

We at AlphaSense have been made aware of fraudulent job postings and individuals impersonating AlphaSense recruiters. These scams may involve fake job offers, requests for sensitive personal information, or demands for payment. Please note:

AlphaSense never asks candidates to pay for job applications, equipment, or training.

All official communications will come from an @alpha-sense.com email address.

If you’re unsure about a job posting or recruiter, verify it on our Careers page.

If you believe you’ve been targeted by a scam or have any doubts regarding the authenticity of any job listing purportedly from or on behalf of AlphaSense please contact us. Your security and trust matter to us.