{"id":1165592,"url":"https://alion.io/job/triumf-cybersecurity-analyst-ii","title":"Cybersecurity Analyst II","company":{"id":1050219,"name":"TRIUMF","domain":"triumf.ca","url":"https://alion.io/company/triumf-ca","size_band":"201-500","is_staffing_agency":false,"is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Vancouver, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":64000,"max_usd":146000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":16},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false},{"name":"Active Directory","optional":true},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"Linux","optional":true},{"name":"Windows","optional":true}],"status":"live","first_seen_at":"2026-09-23T00:00:00Z","employer_posted_date":"2026-09-23","last_verified_at":"2026-09-24T16:57:54Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Discover TRIUMF, Canada's particle accelerator centre. We are a publicly funded, not-for-profit research lab that is a hub for discovery and innovation.\nOur mission is to serve as Canada’s particle accelerator centre. We advance isotope science and technology, both fundamental and applied. We collaborate across communities and disciplines, from nuclear and particle physics to the life and material sciences. We discover and innovate, inspire and educate, creating knowledge and opportunity for all.\nTRIUMF's diverse community of nearly 600 multidisciplinary researchers, engineers, technicians, tradespeople, staff, and students create a unique incubator for Canadian excellence, as well as a portal to premier global collaborations. Fueling innovation and improving lives, we are committed to accelerating discovery and shaping a better world.\nAre you a cybersecurity professional with 5+ years of hands-on experience in technical risk, security architecture, detection engineering, or identity security?\nYou could be a great fit if you bring:\nCybersecurity risk expertise: Lead technical security risk assessments across systems, applications, infrastructure, and projects, identifying vulnerabilities and evaluating whether security controls can effectively prevent or detect real-world attacks\nSecurity architecture expertise: Review networks, cloud environments, applications, and enterprise systems to identify security weaknesses, assess data flows, perform threat modeling, and provide secure design guidance\nDetection engineering: Develop, test, maintain, and improve SIEM, EDR, and other security detection content, while mapping detection coverage to the MITRE ATT&CK framework and addressing security gaps\nIdentity & access management: Assess and strengthen IAM environments, including MFA, SSO, privileged access management, federation, directory services, and zero-trust access controls\nIncident response & investigation: Provide senior technical support during complex cybersecurity incidents, from detection and triage through containment, recovery, and root cause analysis\nVulnerability & threat intelligence: Evaluate vulnerabilities based on exploitability and asset criticality, monitor emerging threats, and translate threat intelligence into practical security improvements\nTechnical leadership & mentorship: Serve as a senior technical resource, providing guidance, coaching, and work review for junior and intermediate cybersecurity analysts\nWhy TRIUMF?\nWork at Canada’s national particle accelerator centre and contribute to cybersecurity in a unique scientific research environment\nCollaborate with a multidisciplinary community of researchers, engineers, technicians, IT professionals, and scientists\nGrow your career through technical leadership, mentorship, continuous learning, and exposure to advanced research environments\nEnjoy a comprehensive total rewards package, including employer-paid health and dental benefits, vision care, pension, disability benefits, wellness benefits, and generous time away\nPRIMARY FUNCTION:\nThe Cybersecurity Analyst II applies deep technical expertise across a broad range of cybersecurity disciplines to evaluate and reduce risk across the organization's systems, infrastructure, and projects. The primary focus of the role is technical risk assessment and security architecture review, examining how systems are built, how they could be attacked, and whether controls in place would actually stop an adversary. In addition, the incumbent owns detection engineering and identity and access management security as core functions, ensuring the organization's defensive capabilities are built on sound design and continuously strengthened. The incumbent operates with minimal direction, exercises independent judgment on complex and ambiguous problems, and is trusted to make sound, technically grounded security decisions.\nThe ideal candidate thinks like an attacker and advises like a trusted advisor. They bring hands-on experience across threat modeling, attack surface analysis, detection content development, identity security architecture, and incident response, and can translate technical risk clearly and credibly to project teams, system owners, and leadership. This role also serves as a senior technical resource for the broader cybersecurity team, providing mentorship and guidance to junior analysts.\nORGANIZATIONAL RELATIONSHIPS:\nThe Cybersecurity Team is a group of the Information Systems and Technology Department (IS&T). The Cybersecurity Analyst II reports directly to the Group Leader, Cybersecurity, and interacts on a day-to-day basis with other members of IS&T and with a broad range of internal stakeholders, system owners, and research groups. This position works with colleagues across all areas of the Lab and in all job functions. External contacts include vendors, consultants, and support service providers.\nRESPONSIBILITIES:\nTechnical Risk Assessment\nLead technical cybersecurity risk assessments of systems, applications, infrastructure, and projects.\nEvaluate control effectiveness to determine whether existing safeguards would realistically detect or prevent an attack.\nEvaluate third-party and vendor security posture prior to onboarding and on an ongoing basis.\nCommunicate risk findings with technical precision to technical stakeholders and in plain institutional impact terms to non-technical stakeholders.\nContribute to risk reporting for governance and leadership forums as a secondary output of technical work.\nSecurity Architecture Review\nReview the security design of proposed and existing systems, networks, applications, and cloud deployments.\nAssess data flows and sensitive data exposure risks as part of architecture reviews, escalating findings to the appropriate owner.\nPerform threat modeling to identify attack paths, trust boundary weaknesses, and exploitable design flaws.\nProvide secure design guidance to engineering and infrastructure teams throughout project lifecycles.\nParticipate in change management processes to assess the security implications of infrastructure and application changes.\nDetection Engineering\nOwn the development and lifecycle management of detection content across SIEM, EDR, and other detection platforms, including writing, testing, validating, and maintaining detection logic\nMap and maintain detection coverage against the MITRE ATT&CK framework, identifying blind spots and prioritizing new detection development based on realistic threat scenarios for the organization.\nTranslate threat intelligence, adversary TTPs, and post-incident findings into new detection use cases, building coverage where gaps exist.\nDocument detection logic, tuning rationale, and coverage decisions to support team knowledge transfer and audit requirements.\nIdentity and Access Management Security\nOwn the security architecture and risk posture of the organization's identity and access management environment, including authentication systems, privileged access management, SSO, federation, and directory services.\nEvaluate IAM designs and configurations, assessing authentication strength, privilege scope, and susceptibility to identity-based attacks such as credential theft, lateral movement, and privilege escalation.\nLead or contribute to zero trust identity initiatives, including least-privilege access design, conditional access policy review, and MFA coverage.\nIdentify and drive remediation of identity architecture weaknesses surfaced through risk assessments, architecture reviews, or incident investigations.\nIncident Response and Security Operations\nLead or provide senior technical support for complex or high-severity cybersecurity incident investigations.\nGuide and mentor junior analysts through triage, containment, eradication, and recovery.\nLead post-incident reviews and root cause analysis, identifying architectural or detection weaknesses and driving remediation.\nSupport the design and execution of incident response tabletop exercises.\nVulnerability Management and Threat Intelligence\nProvide senior technical oversight of vulnerability management, including validation of scan findings, prioritization based on exploitability and asset criticality, and guidance on remediation approaches.\nMonitor threat intelligence feeds and security advisories, evaluate relevance to the organization's architecture and risk posture, and determine prioritization and response.\nAssess emerging vulnerabilities for real-world exploitability and business impact in context.\nIdentify systemic weaknesses and architectural patterns that produce repeated vulnerabilities and recommend structural remediation.\nGovernance and Continuous Improvement\nContribute technical subject-matter expertise to the development and review of cybersecurity policies and standards.\nSupport audits, compliance assessments, and regulatory inquiries by providing technical evidence, documentation, and clear explanation of controls.\nIdentify opportunities to improve the organization's security posture through better architecture, tooling, detection, or process, and lead initiatives to address them.\nLeadership and Mentorship\nProvide technical mentorship and coaching to junior and intermediate cybersecurity analysts, including guidance on assessment methodology, analytical approach, and communicating findings.\nReview and validate the work of junior analysts on risk, detection, and vulnerability assessments.\nAct as the team's primary subject-matter expert and escalation point for complex technical risk, detection, identity, and architecture questions.\nGeneral Duties\nPerform other related duties and responsibilities as assigned, consistent with the scope and level of the position.\nKNOWLEDGE AND SKILLS:\nMust possess strong communication skills, including the ability to explain complex technical attack scenarios, detection logic, and risk findings clearly to both technical peers and non-technical stakeholders and leadership.\nMust demonstrate strong analytical and adversarial thinking, approaching systems from an attacker's perspective and reasoning about how controls would hold up under realistic attack conditions.\nMust demonstrate sound judgment when managing competing priorities, incomplete information, and technically complex or ambiguous risk decisions.\nMust exercise discretion and professionalism in handling sensitive security, risk, and organizational information.\nMust work collaboratively across IT, engineering, research groups, and leadership, and be effective at influencing security outcomes without direct authority.\nPreferred Skills:\nFamiliarity with operational technology and industrial control system security concepts, including secure architecture and risk considerations for research or scientific environments.\nApplication security and secure SDLC: SAST and DAST tooling, dependency and software composition analysis, pipeline security, API security review, and providing hands-on secure coding guidance to development teams.\nMINIMUM QUALIFICATIONS AND YEARS OF EXPERIENCE:\nBachelor's degree in Cybersecurity, Information Technology, Computer Science, or equivalent technical experience.\nMinimum 5 years of hands-on cybersecurity experience, with demonstrated depth in two or more of: technical risk assessment, security architecture review, detection engineering, or identity security.\nCISSP expected at this level, or in active progress. Additional relevant certifications are considered assets, including CCSP, OSCP, SABSA, SC-300 (Microsoft Identity and Access Administrator), or GIAC certifications such as GCIH, GCIA, GDSA, or GPEN.\nSubstantial hands-on experience in several of the following areas:Technical security risk assessments, attack surface analysis, and threat modeling.\nSecurity architecture review of networks, cloud environments, applications, and enterprise systems.\nDetection engineering: authoring SIEM detection content, correlation rules, behavioral analytics, and MITRE ATT&CK coverage mapping.\nIdentity and...","description_format":"text","description_chars":14729,"description_truncated":true,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Equity","Life insurance"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Science & Engineering","Materials Science & Nanotechnology"],"lifecycle":[{"event":"open","at":"2026-09-24T02:45:22Z"}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":45,"reasons":["conf:2","win:early"],"computed_at":"2026-09-24T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/triumf-cybersecurity-analyst-ii","json_url":"https://alion.io/job/triumf-cybersecurity-analyst-ii.json","meta":{"generated_at":"2026-09-24T20:53:51Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers"}}