{"id":74999,"url":"https://alion.io/job/alphasense-security-operations-analyst-ii","title":"Security Operations Analyst II","company":{"id":1557,"name":"AlphaSense","domain":"alpha-sense.com","url":"https://alion.io/company/alphasense","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":75,"open_postings":23,"ghost_share":0,"stale_share":0.783,"repost_share":0,"time_to_fill_p50_days":71,"computed_at":"2026-10-16T05:45:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":{"label":"PT","utc_offset_min":-8,"utc_offset_max":-8},"hiring_geo_confidence":"structured","locations":["Vancouver, Canada"],"countries":["CA"],"hiring_countries":["CA"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":60000,"max_usd":114000,"period":"year","method":"role_seniority_country_cell","sample_n":19},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DNS","optional":false},{"name":"GCP","optional":false},{"name":"Google SecOps","optional":false},{"name":"IAM","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"Okta","optional":false},{"name":"Prisma Cloud","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"TCP/IP","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-08-20T20:59:08Z","employer_posted_date":"2026-08-25","last_verified_at":"2026-10-17T00:24:55Z","board_verified":true,"closed_at":null,"days_open":57,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":57},"description":"About AlphaSense: \nThe world’s most sophisticated companies rely on AlphaSense to remove uncertainty from decision-making. With market intelligence and search built on proven AI, AlphaSense delivers insights that matter from content you can trust. Our universe of public and private content includes equity research, company filings, event transcripts, expert calls, news, trade journals, and clients’ own research content.\nThe acquisition of Tegus by AlphaSense in 2024 advances our shared mission to empower professionals to make smarter decisions through AI-driven market intelligence. Together, AlphaSense and Tegus will accelerate growth, innovation, and content expansion, with complementary product and content capabilities that enable users to unearth even more comprehensive insights from thousands of content sets. Our platform is trusted by over 6,000 enterprise customers, including a majority of the S&P 500. Founded in 2011, AlphaSense is headquartered in New York City with more than 2,000 employees across the globe and offices in the U.S., U.K., Finland, India, Singapore, Canada, and Ireland. Come join us!\nRemote within Canada, able to work in the Pacific time zone\nABOUT THE ROLE\nWe are hiring Security Operations Analyst II to join our Security Operations team in a fully remote capacity from Canada. This role sits at Tier 1-2 in our operating model - you are past the stage of learning what alerts look like and ready to own triage, perform structured investigations, and contribute to detection quality. You will handle the day-to-day alert queue, investigate escalated or ambiguous cases, handle incidents and work closely with senior analysts and the Security Operations Manager to close coverage gaps.\nWe expect you to think analytically, document thoroughly, and operate with growing independence. You will be supported by experienced colleagues and a mature toolset, but you are expected to bring real investigative instinct and a curiosity to grow to the role from day one.\nWHAT YOU WILL DO\nAlert Triage & Investigation\nMonitor and triage alerts across endpoint, network, cloud, runtime and identity data sources with accuracy and appropriate urgency\nPerform structured investigations on escalated or ambiguous alerts: pivot across log sources, correlate events, and build a coherent timeline\nClassify alerts correctly - true positive, false positive, or benign - with documented rationale, not just a verdict\nIdentify scope and blast radius on confirmed incidents: affected users, systems, and data before escalating or containing\nEscalate to senior analysts with a complete investigation package - context, evidence, timeline, and a hypothesis\nIncident Response Support\nParticipate in active incident response under senior analyst or manager direction: evidence collection, log pulls, timeline reconstruction\nExecute containment actions - endpoint isolation, account suspension, token revocation - as directed with documented rationale\nMaintain accurate and timely case documentation throughout the incident lifecycle\nContribute to post-incident timelines and assist with root cause documentation\nCloud & Identity Security Monitoring\nMonitor cloud audit logs and native threat detection findings for suspicious IAM activity, unusual API calls, and access anomalies\nInvestigate identity provider events: suspicious logins, MFA bypass attempts, session anomalies, and unauthorized app assignments\nRecognize common cloud-native attack patterns: credential abuse via metadata service, privilege escalation via IAM role assumption, and storage misconfiguration access\nCorrelate cloud-side events with endpoint and network telemetry to build a fuller picture of attacker activity\nDetection & Quality Improvement\nFlag false positives and noisy detections with enough context for a senior analyst or detection engineer to tune them\nIdentify gaps in existing detection coverage based on alert patterns you observe during triage\nApply knowledge of MITRE ATT&CK to label attacker techniques and communicate findings consistently\nContribute to runbook accuracy by flagging outdated steps or missing guidance encountered during investigations\nParticipate with Detections Engineers to build detections and contribute to automating activity with an Engineering mindset\nDocumentation & Communication\nWrite clear, concise case notes that a colleague could pick up mid-investigation without needing to re-investigate from scratch\nProduce shift handoff summaries that accurately represent open cases, pending actions, and investigation status\nCommunicate incident updates to the Security Operations Manager with sufficient clarity to brief upward without re-investigation\nWHAT WE ARE LOOKING FOR\nRequired\n2-4+ years of hands-on experience in a SOC, or security operations role with direct alert triage responsibility\nSolid understanding of the MITRE ATT&CK framework - you use it to label and communicate attacker behavior, not just reference it\nWorking knowledge of EDR tooling: process tree analysis, behavioral detection review, and basic endpoint artifact interpretation\nFamiliarity with SIEM-based investigation: querying logs, correlating events across sources, and building timelines from normalized data\nUnderstanding of foundational network protocols (TCP/IP, DNS, HTTP/S, TLS) and how attackers abuse them\nExposure to cloud security monitoring ex. AWS or GCP - including audit log review and IAM-related alert investigation\nExperience investigating identity-based alerts in an enterprise identity provider (e.g., Okta, Entra ID, or equivalent)\nStrong written communication: your case notes are accurate, structured, and useful to someone who wasn’t there\nPreferred\nExperience with next-gen EDR platforms (e.g., CrowdStrike Falcon, SentinelOne, or equivalent) beyond basic alert review - RTR, process trees, custom detections\nHands-on SIEM experience with a cloud-native platform (e.g., Google SecOps/Chronicle, Microsoft Sentinel, or equivalent)\nExposure to CSPM or cloud security tooling (e.g., Wiz, Prisma Cloud, or equivalent) as an investigation data source\nFamiliarity with AWS IR fundamentals: CloudTrail, GuardDuty, VPC Flow Logs, IAM chain analysis\nUnderstanding of encoding vs. encryption vs. hashing and their relevance to attacker obfuscation techniques\nExperience working alongside or receiving escalations from a managed detection and response (MDR) partner\nRelevant certifications: CompTIA CySA+, Security+, BTL1, GCIH, or equivalent practical security credential\nAlphaSense is an equal-opportunity employer. We are committed to a work environment that supports, inspires, and respects all individuals. All employees share in the responsibility for fulfilling AlphaSense’s commitment to equal employment opportunity. AlphaSense does not discriminate against any employee or applicant on the basis of race, color, sex (including pregnancy), national origin, age, religion, marital status, sexual orientation, gender identity, gender expression, military or veteran status, disability, or any other non-merit factor. This policy applies to every aspect of employment at AlphaSense, including recruitment, hiring, training, advancement, and termination.\nIn addition, it is the policy of AlphaSense to provide reasonable accommodation to qualified employees who have protected disabilities to the extent required by applicable laws, regulations, and ordinances where a particular employee works.\nRecruiting Scams and Fraud\nWe at AlphaSense have been made aware of fraudulent job postings and individuals impersonating AlphaSense recruiters. These scams may involve fake job offers, requests for sensitive personal information, or demands for payment. Please note:\nAlphaSense never asks candidates to pay for job applications, equipment, or training.\nAll official communications will come from an @alpha-sense.com email address.\nIf you’re unsure about a job posting or recruiter, verify it on our Careers page.\nIf you believe you’ve been targeted by a scam or have any doubts regarding the authenticity of any job listing purportedly from or on behalf of AlphaSense please contact us. Your security and trust matter to us.","description_format":"text","description_chars":8154,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Market Research","Financial AI","AI Search","Financial Data & Market Intelligence"],"lifecycle":[{"event":"open","at":"2026-08-20T20:59:08Z"}],"visa":[],"liveness":{"score":33,"band":"fade","label":"Fading","p_open":1,"p_active":0.555,"p_room":0.6,"age_days":56,"expected_fill_days":71,"reasons":["conf:2","stale_co","velocity","win:late","crowd:brand"],"computed_at":"2026-10-16T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/alphasense-security-operations-analyst-ii","json_url":"https://alion.io/job/alphasense-security-operations-analyst-ii.json","meta":{"generated_at":"2026-10-17T01:40:10Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2353,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1557},"rest":"https://alion.io/mcp/rest/get_company?id=1557"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Falphasense-security-operations-analyst-ii"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Falphasense-security-operations-analyst-ii"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Falphasense-security-operations-analyst-ii"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/alphasense-security-operations-analyst-ii\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Falphasense-security-operations-analyst-ii"}]}