{"id":602669,"url":"https://alion.io/job/actdigital-l3-soc-analyst-incident-responder","title":"L3 SOC Analyst / Incident Responder","company":{"id":668682,"name":"Act Digital","domain":"actdigital.com","url":"https://alion.io/company/actdigital-2","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SmartRecruiters","truth_index":{"grade":"A","score":95,"open_postings":9,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":365,"computed_at":"2026-10-29T05:49:05Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Montreal, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":56000,"max_usd":105000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":53},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"IBM QRadar","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false}],"status":"live","first_seen_at":"2026-01-19T21:32:13Z","employer_posted_date":"2026-01-19","last_verified_at":"2026-10-29T13:17:50Z","board_verified":true,"closed_at":null,"days_open":282,"trust":{"level":"ok","repost_count":0,"flags":[],"days_open":282},"description":"Act Digital is a technology consulting and expertise firm founded in 2006. Our mission is to support our clients with their technical and organizational cybersecurity challenges. Our offering is structured around the following areas of expertise:\nSecurity Management\nArchitecture and Integration\nAudit and Penetration Testing\nCyber Defense\nWe are an international group with 6,500 employees and operations in 12 countries. Our success depends on the development and fulfillment of each employee, and we place great importance on providing the best possible working conditions:\nRemote working is available for a large part of our assignments\nA Flex Office work environment available to everyone at all times to foster communication and collaboration\nCommunities of experts to share and disseminate skills within the group\nProject management and local HR support\nTraining and certification offered annually\nPromotion of our consultants' expertise\nStrong openness to occasional or long-term international mobility\nIntrapreneurship opportunities\nact digital Canada is one of our newest subsidiaries, created in 2023. We have our offices located in downtown Montreal, directly connected to the city's metro network.\n We are looking for an experienced L3 SOC Analyst / Incident Responder to join our cybersecurity team. In this role, you will be responsible for leading advanced threat detection, incident response activities, and driving the continuous improvement of our security operations. You will be a key player in protecting our clients digital assets from sophisticated cyber threats. (3 days on site, 2 day on remote)\nKey Responsibilities:\nAdvanced Threat Detection: Monitor and analyze security events from various sources, including SIEM, EDR, NDR, firewalls, and other protection systems. Identify and respond to advanced persistent threats (APTs) and complex security incidents.\n\nIncident Response: Lead incident response efforts, including investigation, containment, eradication, and recovery. Coordinate with other teams to manage and mitigate security incidents, ensuring minimal impact on business operations.\n\nForensics and Analysis: Perform in-depth forensic analysis on compromised systems, including malware analysis, network traffic analysis, and log analysis. Document findings and provide detailed incident reports.\n\nThreat Hunting: Proactively hunt for hidden threats in the network, using threat intelligence, behavioral analysis, and anomaly detection techniques. Identify and mitigate potential security risks before they escalate.\n\nSecurity Improvements: Collaborate with the SOC team to continuously improve detection capabilities, including tuning and optimizing SIEM rules, developing custom scripts, and integrating new tools and technologies.\n\nTraining and Mentorship: Provide guidance and mentorship to junior SOC analysts (L1/L2), sharing knowledge and best practices for incident response and threat detection.\n\nPost-Incident Reporting: Prepare detailed post-incident reports that include root cause analysis, impact assessments, and recommendations for future prevention measures. Communicate findings to senior management and relevant stakeholders.\n\nIncident Playbooks: Develop and maintain incident response playbooks, ensuring they are up-to-date and aligned with the latest threat landscape and industry best practices.\n\nCollaboration: Work closely with other IT and security teams, including vulnerability management, IT operations, and network security, to strengthen the organization’s overall security posture.\n\n Experience:\n5+ years of experience in a SOC environment, with a focus on incident response and advanced threat detection.\nProven track record of handling complex security incidents and conducting forensic investigations.\n\nTechnical Skills:\nExpertise in SIEM platforms (e.g., Splunk, QRadar), IDS/IPS, firewalls, and endpoint detection and response (EDR) tools.\nProficiency in scripting languages (e.g., Python, PowerShell) for automation and custom detection use cases.\nStrong understanding of network protocols, malware analysis, and cybersecurity frameworks (e.g., MITRE ATT&CK, NIST).\nExperience with threat hunting techniques and tools, as well as familiarity with threat intelligence platforms.\n\nSoft Skills:\nExcellent problem-solving skills and the ability to work under pressure during high-stress incidents.\nStrong communication skills, capable of explaining technical issues to both technical and non-technical stakeholders.\nA proactive mindset with a passion for staying current with the latest cybersecurity trends and threats.\n\nEducation:\nBachelor’s degree in Computer Science, Information Security, or a related field is preferred.\n 3 days in the office / 2 days on remote","description_format":"text","description_chars":4740,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","IT Consulting & Digital Transformation","IT Outsourcing & Dedicated Teams","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-09-10T17:51:38Z"}],"visa":[],"liveness":{"score":51,"band":"ok","label":"Likely open","p_open":1,"p_active":0.851,"p_room":0.6,"age_days":282,"expected_fill_days":365,"reasons":["conf:1","velocity","win:late","crowd:"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/actdigital-l3-soc-analyst-incident-responder","json_url":"https://alion.io/job/actdigital-l3-soc-analyst-incident-responder.json","meta":{"generated_at":"2026-10-29T17:25:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26079,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":668682},"rest":"https://alion.io/mcp/rest/get_company?id=668682"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Factdigital-l3-soc-analyst-incident-responder"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Factdigital-l3-soc-analyst-incident-responder"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Factdigital-l3-soc-analyst-incident-responder"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/actdigital-l3-soc-analyst-incident-responder\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Factdigital-l3-soc-analyst-incident-responder"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":602669}},{"tool":"search_jobs","arguments":{"company":"actdigital.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":602669},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}