IT Security Analyst

Role summary

Key responsibilities

• Develop, maintain, and review information security policies, standards, procedures, and guidelines.
• Assess security posture through vulnerability assessments, configuration reviews, risk assessments, and coordinated penetration testing.
• Track and remediate vulnerabilities across infrastructure, applications, cloud services, and endpoints; coordinate testing engagements and resolution of findings.
• Monitor security alerts, logs, and threat intelligence; review and improve configurations across servers, workstations, networks, and cloud platforms.
• Coordinate incident response, including investigation, containment, recovery, escalation, documentation, and post-incident review.
• Maintain and test response plans, playbooks, escalation procedures, and communications protocols.
• Oversee identity and access management, privileged access, and periodic user access reviews.
• Assess third-party vendors and service providers and track remediation of identified risks.
• Provide security guidance for systems, applications, integrations, infrastructure changes, and technology projects.
• Deliver awareness training and phishing simulations; maintain metrics, risk registers, and remediation records and report risks and improvement priorities to leadership.
• Support business continuity, disaster recovery, backup-security testing, and resilience exercises.
• Track emerging threats, vulnerabilities, regulations, standards, and technologies; recommend improvements and collaborate across IT, Legal, HR, Privacy, operations, and external providers.

Education and experience

• Diploma or bachelor's degree in Cybersecurity, IT, Computer Science, Information Systems, or a related field; equivalent training and experience may be considered.
• At least 3 years of experience in cybersecurity, information security, security analysis, or a related role.
• Experience with security monitoring, vulnerability management, incident response, risk assessment, and policy development.
• Experience in enterprise Windows, network, cloud, and Microsoft 365 environments is an asset.

Knowledge and skills

• Working knowledge of NIST Cybersecurity Framework, CIS Controls, ISO/IEC 27001, or comparable standards.
• Knowledge of Microsoft 365 security, endpoint protection, SIEM, log management, firewalls, vulnerability tools, identity and access management, and cloud security principles.
• Strong analytical, investigative, documentation, and problem-solving skills, including practical risk assessment and proportionate control recommendations.
• Able to communicate technical risks and recommendations to technical and non-technical stakeholders; exercises sound judgment, discretion, and attention to detail.

Certification

• A recognized cybersecurity certification is required. Examples include CompTIA Security+, GSEC, SSCP, CISSP, CISM, CEH, or a Microsoft security certification; additional relevant certifications are an asset.

Working conditions

• Work is primarily in an office and computer-based environment with extended screen use.
• Occasional work outside regular hours may be required for incidents, testing, upgrades, maintenance, or recovery activities.
• The role requires managing competing priorities and responding effectively to time-sensitive situations.

What we offer

• The source description begins a benefits section mentioning opportunities for professional development; the remaining benefits text is not present in the provided description.