{"id":3601894,"url":"https://alion.io/job/kyndryl-soc-t3-expert","title":"SOC T3 Expert","company":{"id":91,"name":"Kyndryl","domain":"kyndryl.com","url":"https://alion.io/company/kyndryl","size_band":"5000+","is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":84,"open_postings":140,"ghost_share":0,"stale_share":0.614,"repost_share":0.021,"time_to_fill_p50_days":35,"computed_at":"2026-11-06T05:58:05Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Barrie, Canada"],"countries":["CA"],"hiring_countries":["CA"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cobalt Strike","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"IBM QRadar","optional":false},{"name":"Kali Linux","optional":false},{"name":"Linux","optional":false},{"name":"Metasploit","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"MITRE D3FEND","optional":false},{"name":"NIST CSF","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Windows","optional":false}],"status":"closed","first_seen_at":"2026-11-02T09:39:48Z","employer_posted_date":"2026-11-02","last_verified_at":"2026-11-04T23:01:36Z","board_verified":false,"closed_at":"2026-11-04T23:01:36Z","days_open":2,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":2},"description":"Who We Are\nAt Kyndryl, we run and reimagine the mission-critical technology systems that drive advantage for the world’s leading businesses. We are at the heart of progress; with proven expertise and a continuous flow of AI-powered insight, enabling smarter decisions, faster innovation, and a lasting competitive edge. For our people-Kyndryls-that means doing purposeful work that powers human progress. Join us and experience a flexible, supportive environment where your well-being is prioritized and your potential can thrive.\n The Role\nThe security delivery support clients in managing their Security Operations and protecting their environments to mitigate security risks (e.g., insider and external threats, intentional and accidental). Position is for an experienced security professional with demonstrated experience within Security Operations, Threat Detection & Response, Security Intelligence, CSM (Continuous Security Monitoring) and NSM (Network Security Monitoring) within the SOC operations environment.\nLead complex investigations and conduct deep analysis of security events focused on rapid containment, remediation, and mitigation.\nLead in the detection, triage, analysis and response to cyber-attacks. Serve as a technical Cyber SME and onsite task lead.\nProvide insight and expertise to examine malicious code (malware), attack vectors, network communication methods, analyze threats against target systems and networks, determine target network capabilities and vulnerabilities.\nTraining and mentoring Level 1 & Level 2 peers to improve SOC Analyst capability.\nEngaging across the organization and partnership with a diverse set of IT and business stakeholders, awareness of business needs for delivery and agility and to ensure security topics (operations, engineering, risk, compliance) are integrated and automated properly.\nWorking with Cybersecurity, Information Technology Services teams, and others across the global business organization on practical implementation of SOAR and SOC Runbooks and Playbooks\nIdentifying, monitoring, and reporting on trackable metrics to improve processes, procedures, and overall operational security while minimizing business impact\nPerform Security Operations maturity assessments, formulate roadmaps to bridge existing security gaps and help accelerate transformation towards SOC maturity.\nReviewing SOC Runbooks and Playbooks and determining if good practices are being followed, considering most common cybersecurity threats within clients’ industries, business and Geo locations. \nReviewing SOAR and XDR products utilized and determining if they are configured properly.\nDeploying SOC automation technology through SOAR, Case Management.\nReviewing Security Operations Runbooks and Playbooks through assessing SOC threat landscape; existing automations and providing recommendations to comply with SOC automation best practices, using applicable cybersecurity framework.\nA willingness to go beyond the ordinary to meet and exceed client expectations.\nYour future at Kyndryl\nEvery position at Kyndryl offers a way forward to grow your career. We have opportunities that you won’t find anywhere else, including hands-on experience, learning opportunities, and the chance to certify in all four major platforms. Whether you want to broaden your knowledge base or narrow your scope and specialize in a specific sector, you can find your opportunity here\nWho You Are\nYou’re good at what you do and possess the required experience to prove it. However, equally as important - you have a growth mindset; keen to drive your own personal and professional development. You are customer-focused - someone who prioritizes customer success in their work. And finally, you’re open and borderless - naturally inclusive in how you work with others.\nRequired Technical and Professional Experience\nBachelor’s degree in Computer Science, Cybersecurity, Information Technology, or other related fields, from an accredited university. Equivalent professional experience can be used in lieu of a degree.\n8+ years of security analyst experience, preferably in a managed services environment.\nA minimum of 5 years “hands-on” experience on SOC operations (Standard Operations Procedures, Runbook and Playbooks).\nExperience threat hunting, proactively and iteratively searching to detect advanced threats that evade existing security solutions.\nExpertise in network, host, and cloud-based security, attack techniques, analysis, and investigation\nStrong experience with Operating systems (Windows, Linux and MacOS) & IT Architecture\nDeep understanding of a variety of logs coming from cloud, network or endpoint devices.\nExpert level understanding of advanced attacks and defense techniques.\nExperience in Cloud Security monitoring and in advanced analytics (UEBA)\nExperience with leading security incident response\nExperience with triaging various disparate anomalies to detect meaningful threat scenarios.\nSound experience on programming languages: Python and/or R. and/or PowerShell\nExperience in REST API interfaces to support data collection or integration.\nExperience with Data monitoring / Data Science\nStrong Understanding of the current cyber threat landscape, the different tactics commonly used by adversaries and how you would investigate, contain and recover against their attacks.\nDeep knowledge in the most common and used frameworks (E.g., NIST CSF, ISO2700x, CMM SOC, etc.)\nEnglish: Fluent\nStrong critical thinking and analytical skills and ability to think “out of the box” required.\nMust be able to work independently or with a team, under minimum supervision.\nMust have or be eligible for Canadian Secret Clearance (Level II)\nPreferred Technical and Professional Experience\nMBA or master’s degree\nA minimum of 8 years hands on experience with one or more of the following areas:Operation and Implementation of SIEM solutions including:QRadar or Splunk and Microsoft Sentinel.\n\nOperation and Implementation of Security Automation solutions including:Thorough knowledge of SOAR (Security Orchestration Automation & Response) technologies.\n\nDesing and Implementation of Monitoring strategy including:Thorough knowledge on defining data sources monitoring based on clients’ business \nThorough knowledge on MITRE Frameworks (ATT&CK, D3FEND)\nFamiliar with Cyber Kill Chain\n\nDesing and Implementation of Configuration Governance solutions including:Thorough knowledge on how to operationalize ongoing security configuration governance service using SOC standard methodologies, metrics, KPIs, KRIs, Operational Procedures.\n\nCyber Network Operations/Penetration Test Methodologies and tools like Metasploit, Kali Linux, Cobalt Strike etc.,\n\nBeing You\nThe “Kyn” in Kyndryl means kinship, which represents the strong bonds we have with each other, our customers and our communities. We focus on ensuring all Kyndryls feel included and we welcome people of all cultures, backgrounds, and experiences. Even if you don’t meet every requirement, we encourage you to apply. We believe in growth, and we’re excited to see what you can bring. At Kyndryl, employee feedback has told us that our number one driver of employee engagement is belonging. That sense of belonging - being a valued, respected, trusted member of the team - is fundamental to our culture and fueling great experiences for our customers. This dedication to welcoming everyone into our company means that Kyndryl gives you the ability to thrive and contribute to our culture of empathy and shared success. That’s The Kyndryl Way.\nWhat You Can Expect\nYour career with us isn’t just a job-it’s an adventure with purpose. We offer a dynamic, hybrid-friendly culture that supports your well-being and empowers you to grow. Our Be Well programs are thoughtfully designed to support your financial, mental, physical, and social health-because we know that when you feel your best, you do your best. \nFrom your very first day, you’ll dive into impactful work that powers the systems our customers rely on every day. You won’t just contribute-you’ll make a difference, tackling meaningful projects that sharpen your skills and fuel your growth.\nWe’re here to champion your journey. With powerful tools to chart your career path, personalized development goals aligned with your ambitions, and continuous feedback to keep you inspired and on track, you’ll have everything you need to thrive and evolve. You’ll develop in-demand skills to grow your career and achieve your ambitions with access to cutting-edge learning opportunities-from certifications with Microsoft, Google, and Amazon to coaching and hands-on experiences. And through it all, you’ll be part of a culture that values empathy, restless learning, and a devotion to shared success. \nWe want you to thrive here-and we’re committed to helping you do just that. Ready to make an impact? Join us and help shape what’s next.\nGet Referred!\nIf you know someone that works at Kyndryl, when asked ‘How Did You Hear About Us’ during the application process, select ‘Employee Referral’ and enter your contact's Kyndryl email address.","description_format":"text","description_chars":9092,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":true,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Professional development"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","IT Infrastructure & Networking Services","Systems Integrators","Cloud Consulting & Migration"],"lifecycle":[{"event":"open","at":"2026-11-02T09:39:48Z"},{"event":"close","at":"2026-11-04T23:01:36Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/kyndryl-soc-t3-expert","json_url":"https://alion.io/job/kyndryl-soc-t3-expert.json","meta":{"generated_at":"2026-11-06T06:47:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11984,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":91},"rest":"https://alion.io/mcp/rest/get_company?id=91"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fkyndryl-soc-t3-expert"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fkyndryl-soc-t3-expert"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fkyndryl-soc-t3-expert"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/kyndryl-soc-t3-expert\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fkyndryl-soc-t3-expert"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3601894}},{"tool":"search_jobs","arguments":{"company":"kyndryl.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3601894},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}