{"id":1219131,"url":"https://alion.io/job/ey-senior-security-operations-analyst-microsoft-sentinel-and-defender","title":"Senior Security Operations Analyst - Microsoft Sentinel and Defender","company":{"id":2859,"name":"EY","domain":"ey.com","url":"https://alion.io/company/ey-com","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"SuccessFactors","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Edmonton, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":90500,"max":126000,"currency":"CAD","period":"year","gross":null,"usd_annual":88510},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Lighthouse","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"ServiceNow","optional":false}],"status":"live","first_seen_at":"2026-09-23T00:00:00Z","employer_posted_date":"2026-09-23","last_verified_at":"2026-10-25T16:17:16Z","board_verified":true,"closed_at":null,"days_open":32,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":32},"description":"At EY, we’re all in to shape your future with confidence.\nWe’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go.\nJoin EY and help to build a better working world.\nThe opportunity\nEY is seeking a senior, hands-on security operations analyst to support Managed Detection and Response services in a multi-customer Managed Security Service Provider environment.\nYou will lead complex security incident investigations using Microsoft Sentinel and Microsoft Defender XDR, perform threat hunting and detection tuning, and improve response workflows through Microsoft Sentinel automation rules, playbooks, and Azure Logic Apps. You will work across multiple customer environments, provide technical guidance to other analysts, and communicate clear findings and response recommendations to clients.\nThe successful candidate will bring strong investigative judgement, advanced Microsoft security platform experience, and the ability to manage concurrent incidents and priorities in a client-facing environment.\nThis job posting relates to an existing vacancy within our organization.\nYour key responsibilities:\nAs a senior technical member of the security operations team, you will:\nSecurity incident investigation and response\nLead the triage and investigation of complex or high-severity security incidents across multiple customer environments.\nCorrelate endpoint, identity, email, cloud, network, and threat intelligence evidence to determine incident scope, root cause, and business impact.\nDevelop investigation timelines, document evidence, identify attacker activity, and recommend containment and remediation actions.\nCoordinate escalations and response activities with clients, internal teams, and other technical specialists.\nProduce clear incident records, client communications, and post-incident findings.\nMicrosoft Sentinel and Defender operations\nUse Microsoft Sentinel and Microsoft Defender XDR to investigate, prioritize, and respond to security alerts and incidents.\nInvestigate activity across Microsoft Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud Apps, and Defender for Cloud.\nWrite and optimize Kusto Query Language queries for incident investigation, threat hunting, reporting, and detection validation.\nReview and tune analytics rules, hunting queries, workbooks, watchlists, parsers, and related detection content.\nIdentify gaps in telemetry, detection coverage, and platform configuration, then recommend practical improvements.\nAutomation and continuous improvement\nDesign, build, test, and maintain Microsoft Sentinel automation rules and playbooks using Azure Logic Apps.\nAutomate incident enrichment, triage, notification, ticketing, evidence collection, and approved containment actions.\nTroubleshoot playbook failures, integration issues, permissions, API connections, and workflow reliability.\nImprove analyst workflows and standard operating procedures based on incident lessons, recurring alert patterns, and service metrics.\nApply appropriate approvals, access controls, logging, and error handling to automated response actions.\nMSSP service delivery\nManage investigations and technical priorities across multiple customers with different environments, procedures, and service commitments.\nFollow customer-specific rules of engagement, escalation paths, response procedures, and service-level requirements.\nWork directly with client security and technology teams to gather context, explain findings, and recommend next steps.\nSupport onboarding and operational improvement of customer environments, including data connectors, telemetry validation, and incident workflows.\nProvide technical coaching and peer review to other analysts without direct people-management responsibility.\nSkills and attributes for success\nSenior-level experience investigating complex cybersecurity incidents in a Security Operations Centre, Managed Detection and Response, or incident response environment.\nStrong hands-on experience with Microsoft Sentinel and Microsoft Defender XDR in production environments.\nExperience supporting multiple customers in an MSSP or MDR environment is strongly preferred.\nAdvanced Kusto Query Language skills for investigation, threat hunting, detection development, and reporting.\nHands-on experience creating and maintaining Microsoft Sentinel analytics rules, hunting queries, workbooks, automation rules, and playbooks.\nHands-on experience building Azure Logic Apps for security orchestration and response, including connectors, APIs, authentication, permissions, error handling, and monitoring.\nExperience investigating endpoint, identity, email, cloud, and network threats using Microsoft and third-party telemetry.\nStrong understanding of incident response, threat hunting, detection engineering, threat intelligence, and MITRE ATT&CK.\nAbility to manage concurrent investigations and priorities while maintaining clear documentation and timely client communication.\nAbility to explain technical findings, risk, and response recommendations to both technical and non-technical stakeholders.\nSound judgement when working under pressure and handling high-severity incidents.\nTo qualify for the role you must have\nTypically, 5+ years of cybersecurity experience, including substantial recent experience in security operations and incident investigation.\nBachelor’s degree or diploma in cybersecurity, computer science, information technology, engineering, or a related discipline, or equivalent practical experience.\nExperience in a client-facing MSSP, MDR, consulting, or enterprise security operations role.\nMicrosoft Certified: Security Operations Analyst Associate, SC-200, is preferred.\nAzure, Microsoft security, incident response, digital forensics, or cloud security certifications are considered assets.\nExperience with ServiceNow or another IT service management platform is considered an asset.\nExperience with source control, infrastructure as code, CI/CD, or automated deployment of Microsoft Sentinel content is considered an asset.\nExperience with Azure Lighthouse, Microsoft Entra B2B, or other multi-tenant access models is considered an asset.\nWhat working at EY offers\nWhat we look for\nWe look for individuals who take initiative, demonstrate strong technical judgment, and show the ability to lead through influence. If you thrive in collaborative environments and are passionate about improving operational efficiency, this role is an excellent fit.\nWhat we offer\nWe offer a competitive compensation package where you’ll be rewarded based on your performance and recognized for the value you bring to our business. In addition, our Total Rewards package allows you to decide which benefits are right for you and which ones help you create a solid foundation for your future. Our Total Rewards package includes a discretionary bonus program, a comprehensive medical, prescription drug and dental coverage plan, a defined contribution pension plan, a great vacation policy plus firm paid days that allow you to enjoy longer long weekends throughout the year, statutory holidays and paid personal days (based on province of residence), and a range of exciting programs and benefits designed to support your physical, financial and social well-being. Plus, we offer:\nSupport and coaching from some of the most engaging colleagues in the industry\nLearning opportunities to develop new skills and progress your career\nThe freedom and flexibility to handle your role in a way that’s right for you\nEY reports salary ranges in accordance with applicable provincial pay transparency legislation. Individual salaries within the anticipated salary ranges noted below are determined through a wide variety of factors including but not limited to internal equity, education, relevant experience, knowledge, and applicable skill sets.\nToronto/London/Ottawa/Waterloo/Vancouver/Victoria/ Calgary/ Edmonton: $90,500 to $126,000\nAre you ready to shape your future with confidence? Apply today.\nTo help create the best experience during the recruitment process, please describe any accommodations you may need.\nInclusiveness at EY\nInclusiveness is at the heart of who we are and how we work. We’re committed to fostering an environment where differences are valued, policies and practices are equitable, and our people feel a sense of belonging. We embrace diversity and are committed to combating systemic racism, advancing gender equity and women in leadership, advocating for the 2SLGBTQIA+ community, promoting our neuroinclusion and accessibility initiatives, and are dedicated to amplifying the voices of Indigenous peoples (First Nations, Inuit, and Métis) nationally as we strive towards reconciliation. Our diverse experiences, abilities, backgrounds, and perspectives make our people unique and help guide us. Because when people feel free to be their authentic selves at work, they bring their best and are empowered to build a better working world.\nLearn about our commitment to Inclusiveness at https://www.ey.com/en_ca/about-us/corporate-responsibility/equity\nEY | Building a better working world\nEY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.\nEnabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.\nEY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.\nAt EY, we use artificial intelligence (AI) tools as one element of our recruitment process to enhance efficiency and improve the candidate experience. While AI supports us in our process, human judgment and decision-making remain integral in our candidate experience. We are committed to the responsible use of AI, and our practices are continuously reviewed and refined to ensure they align with ethical principles and regulatory requirements.\nTo all recruitment agencies: EY does not accept unsolicited resumes from recruitment agencies. Any resumes submitted without a prior agreement or request from our hiring team will not be considered. EY is not responsible for any fees related to unsolicited resumes.","description_format":"text","description_chars":10489,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Financial Advisory, Valuation & Restructuring","Management Consulting","Tax Advisory & Preparation"],"lifecycle":[{"event":"open","at":"2026-09-25T11:32:59Z"}],"visa":[],"liveness":{"score":41,"band":"fade","label":"Fading","p_open":1,"p_active":0.743,"p_room":0.55,"age_days":32,"expected_fill_days":26,"reasons":["conf:3","velocity","win:tail","comp:brand"],"computed_at":"2026-10-25T05:49:26Z"},"pay":{"stated_usd_annual":88510,"is_top_pay":false},"html_url":"https://alion.io/job/ey-senior-security-operations-analyst-microsoft-sentinel-and-defender","json_url":"https://alion.io/job/ey-senior-security-operations-analyst-microsoft-sentinel-and-defender.json","meta":{"generated_at":"2026-10-25T19:41:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":27880,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2859},"rest":"https://alion.io/mcp/rest/get_company?id=2859"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fey-senior-security-operations-analyst-microsoft-sentinel-and-defender"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fey-senior-security-operations-analyst-microsoft-sentinel-and-defender"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fey-senior-security-operations-analyst-microsoft-sentinel-and-defender"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ey-senior-security-operations-analyst-microsoft-sentinel-and-defender\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fey-senior-security-operations-analyst-microsoft-sentinel-and-defender"}]}