Level 3 Cybersecurity Analyst (SOC)
Role Overview
The Level III Cybersecurity Analyst position is responsible for providing security expertise to the 24/7 Security Operations Center (SOC). The primary objective of this position is to contribute to the coordination and monitoring of cyber incidents affecting the bank’s critical assets by detecting, preventing, and responding to cyber threats targeting the group’s infrastructure. This role provides essential support to the organization’s overall cybersecurity program through close collaboration with the various lines of business across the region, as well as with external clients, partners, and regulatory authorities. As a Production Security Analyst, you will be responsible not only for the real-time monitoring, analysis, and resolution of identified security incidents, but also for the continuous improvement and development of the 24/7 Security Operations Center (SOC) capabilities, which serve as the first line of defense in identifying potential information security incidents.
Key Skills for This Role
Full Job Posting
Responsibilities
- Analyze security log data from a wide range of heterogeneous security devices and identify trends;
- Be responsible for the development and validation of use cases;
- Provide Incident Response (IR) support or escalate when analysis confirms that an incident requires action;
- Perform threat and vulnerability analysis and provide security advisory services;
- Develop the Threat Hunting program and capabilities;
- Analyze and respond to previously undisclosed software and hardware vulnerabilities;
- Investigate, document, and report on information security issues and emerging trends;
- Perform Threat Hunting activities to identify potential malicious actors within the network;
- Perform digital forensic investigations on compromised systems to determine the extent and nature of the compromise and provide recommendations regarding appropriate remediation measures;
- Provide support and conduct research regarding any security-related questions or incidents;
- Perform tasks independently with some level of oversight;
- Integrate and share information with other analysts and teams;
- Monitor the bank’s various sources for potential security incidents, health alerts related to monitored solutions, and requests for information. This includes monitoring real-time channels or dashboards, periodic reports, email inboxes, help desks or other ticketing systems, telephone calls, and chat sessions;
- Follow incident-specific procedures to triage potential security incidents, validate them, determine the necessary mitigation measures, and keep these procedures up to date;
- Escalate potential security incidents to Level IV engineers, implement countermeasures in response to requests, and recommend operational improvements;
- Accurately document incident information and notes in the case management system;
- Maintain up-to-date knowledge of the bank’s technology architecture, known vulnerabilities, the architecture of the security solutions used for monitoring, imminent and widespread threats identified through client threat intelligence, and recent security incidents;
- Continuously improve the service by identifying and addressing issues or knowledge gaps, including analysis procedures, response playbooks, and client network models; tuning false positives; and identifying and recommending new or updated tools, content, countermeasures, or scripts;
- Serve as a subject matter expert in at least one security-related area, such as a specific anti-malware solution, Python programming, etc.;
- Actively seek to develop skills through continuous learning and pursue advancement to a Level IV Analyst position;
- Comply with internal operational security policies as well as other BNP Paribas policies;
- Perform limited-scope project work as required.
Qualifications
- Connaissance ou 3 à 5 ans d’expérience avec les technologies suivantes: SIEM, ELK, IDS/IPS, pare-feu réseau et hôte, solutions de prévention des fuites de données (DLP);
- Expérience pratique avec les logiciels antivirus, les solutions de détection et de réponse sur les terminaux (EDR), les pare-feu et les solutions de filtrage de contenu;
- Expérience ou connaissances démontrables en réponse aux incidents, analyse de journaux ("logs") et analyse de captures réseau (PCAP);
- Bonne connaissance des principes fondamentaux des réseaux, notamment: modèle OSI, TCP/IP, DNS, HTTP(S) et SMTP;
- Bonne compréhension des méthodes utilisées par les acteurs malveillants pour attaquer un réseau, notamment l’hameçonnage ("phishing"), le balayage de ports ("port scanning"), les attaques contre les applications Web, les attaques DDoS et les mouvements latéraux;
- Connaissance des systèmes d’exploitation Windows et/ou Linux, ainsi que des méthodes permettant de les analyser afin d’identifier des signes de compromission;
- Réel intérêt pour l’apprentissage et volonté de contribuer au développement continu de l’équipe;
- Connaissances de base en langages de script ("scripting").
- Capacité à démontrer une méthodologie rigoureuse dans l’investigation des alertes et/ou des indicateurs de compromission, et à documenter les conclusions de manière à ce qu’elles soient compréhensibles aussi bien par les collègues techniques que par les membres de la haute direction;
- Bonne compréhension des rôles complémentaires des différentes équipes de cybersécurité et capacité à collaborer avec celles-ci, notamment les équipes de forensique numérique, renseignement sur les menaces ("Threat Intelligence"), tests d’intrusion ("Penetration Testing"), gestion des vulnérabilités, etc.;
- Capacité à gérer des charges de travail variables, des priorités concurrentes et plusieurs activités simultanément;
- Excellentes capacités d’analyse;
- Excellente communication en français et en anglais. L'anglais est requis, le poste demandant de communiquer avec des clients et des partenaires situés à l'extérieur du Québec.
- Seuls les candidat(es) légalement autorisés(ées) à travailler pour tout employeur au Canada seront considérés(ées)
- Wepoint Benefits
- Minimum of 3 weeks of vacation starting from the first year;
- Comprehensive group insurance with a generous employer contribution;
- Employer contribution to a group RRSP;
- Full remote work flexibility: Hybrid, Remote, or On-site;
- A warm, bright, and welcoming office offering fresh fruit, coffee, beverages, occasional meals, etc.;
- Annual IT equipment budget;
- A balanced work environment with flexible working hours;
- Career development: training and certifications, online or in-person learning, Wepoint Academy, etc.;
- An international community of experts ready to share their knowledge;
- A company culture focused on individuals’ needs and their belonging to a strong community.
- #tech&security
- Permis CNESST: AP-2504754, AP-2504755, AR-2504756
About Onepoint
International consulting firm specializing in digital transformation.
Visit company websiteJobs and hiring trendsApply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at Onepoint
Spécialiste fonctionnel(le) Sailpoint IIQ
Montréal, CAN
Onepoint recherche un spécialiste fonctionnel SailPoint IdentityIQ pour définir les besoins, règles et processus de gestion des identités et des accès. Vous contribuerez à la conception RBAC, à la documentation fonctionn
Analyste Affaires, assurances
Montréal, CAN
Wepoint recherche un·e analyste d’affaires spécialisé·e en réclamations d’assurance pour soutenir des projets complexes et des initiatives stratégiques. Le poste exige au moins six ans d’expérience pertinente, une expéri
Conseiller(ère) en architecture de solutions - Intelligence artificielle
Montréal, CAN
Spécialiste fonctionnel(le) Sailpoint IIQ
Montréal, CAN
Level 3 Cybersecurity Analyst (SOC)
Montréal, CAN
Chargé(e) de projet sénior
Montréal, CAN
Conseiller(ère) en amélioration des processus
Montréal, CAN
Analyste / Administrateur Salesforce
Montréal, CAN
Analyste Affaires, assurances
Montréal, CAN
Conseiller(ère) en architecture de solutions - Intelligence artificielle
Montréal, CAN
Chargé(e) de solutions numériques - Scrum Master
Québec, CAN