Cybersecurity AnalystApplication Deadline:31 March 2026Department:TechnologyEmployment Type:Fixed Term ContractLocation:Head OfficeCompensation:$115,000 - $138,000 / yearDescriptionRole SummaryWe are seeking a Contract Security Analyst with hands‑on experience across Netskope SSE, Microsoft Purview (full DLP), Microsoft Defender, and Arctic Wolf MDR. This role blends security operations, incident response, and data loss prevention engineering, supporting both day‑to‑day alert handling and continuous improvement of detection and data protection controls.The analyst will act as a key technical partner to internal IT teams and the Arctic Wolf SOC, helping reduce risk, improve signal quality, and ensure strong visibility and control over cloud usage and sensitive data.Key Responsibilities1. Security Monitoring, Investigation & Incident ResponseMonitor, triage, and investigate security alerts originating from:Arctic Wolf MDRMicrosoft Defender(Endpoint, Identity, Office 365, Cloud Apps)Netskope SSE(SWG, CASB, ZTNA, Threat Protection, DLP)Perform incident response activities including:Alert validation, scoping, and root‑cause analysisEndpoint, identity, cloud, and SaaS activity investigationContainment actions (account suspension, device isolation, session revocation, policy enforcement)Work closely withArctic Wolfon:Case escalations and response coordinationValidation of detections and recommended actionsProduce clear incident documentation, including:Timelines, affected assets, impact assessment, and remediation steps2. Detection Engineering & Alert Tuning (NonSIEM)Tune and optimize detections and policies directly within:Microsoft Defenderportals (no Sentinel)Netskopesecurity and DLP policiesArctic Wolfescalation criteria and response workflowsReduce alert fatigue by:Eliminating false positivesAligning severity with business impactImproving investigation context and signal fidelityContribute to detection coverage for:Identity compromise and OAuth abuseMalware, ransomware, and lateral movementRisky SaaS usage and anomalous cloud behaviorData exfiltration and policy violations3. Data Loss Prevention & Information ProtectionAdminister and enhanceMicrosoft Purview Information Protection and DLP, including:Sensitivity labels and label policiesDLP policies across Exchange, SharePoint, OneDrive, and TeamsAlert triage and incident follow‑up for DLP events for DLP eventsDesign, implement,



and tuneNetskope DLP :Inline and at rest controls across web and cloud appsClassification, fingerprinting, and structured/unstructured data detectionPartner with business and privacy stakeholders to:Translate data protection requirements into enforceable controlsImplement exception handling and user education workflowsBalance risk reduction with business usabilityTrack and report on DLP effectiveness and trends4. Netskope SSE Platform OperationsSupport the fullNetskope SSE stack, including:Secure Web Gateway (SWG)CASB (managed and unmanaged apps)ZTNAThreat ProtectionDLPMonitor policy health, coverage, and enforcement effectivenessIdentify and remediate gaps in visibility, control, or loggingSupport investigations involving risky apps, shadow IT, and cloud misuse5. Platform Hygiene, Documentation & ReportingValidate security tool coverage and operational health:Endpoint onboarding and Defender healthIdentity and SaaS integrationsLogging completeness and alert flowDevelop and maintain:Incident response playbooksDLP and investigation runbooksOperational procedures and escalation pathsProduce actionable reporting for leadership:Incident trends, alert quality, DLP metrics, and risk themesSupport knowledge transfer and operational maturity improvementsRequired Skills and Experience3–5+ years in aSecurity Analyst, SOC, or Incident ResponseroleHands‑on experience with:Microsoft Defender(Endpoint, Identity, Office 365, Cloud Apps)Microsoft Purview(Information Protection and full DLP)Netskope(SWG, CASB, ZTNA, DLP, Threat Protection)Arctic Wolf MDR(case handling, escalations, collaboration)Strong understanding of:Cloud and SaaS security threatsIdentity‑based attacks and phishingData protection and regulatory considerationsIncident response lifecycle and MITRE ATT&CK; conceptsAbility to clearly document findings and communicate with both technical and nontechnical stakeholdersNice-to-Have QualificationsExperience with:Defender XDR Advanced HuntingSecurity policy design for large M365 environmentsSaaS governance and cloud risk managementCertifications (preferred but not required):SC200, SC400, AZ500, Security+, or equivalentWhat Success Looks LikeWithin the first 60 days, the contractor is expected to:Reduce alert noise through documented tuning improvementsImprove clarity and consistency of incident response processesDeliver measurable improvements in DLP signal qualityEnsure full coverage and operational health across Defender, Netskope, and PurviewLeave behind clear documentation and operational artifactsDon’t meet every single requirement? That’s okay. We encourage you to apply anyway. We believe in investing in potential and supporting our team members as they grow into their roles. If this opportunity excites you, but your experience doesn’t align perfectly, we still want to hear from you.BenefitsAs an employee at Embark you will benefit from so many great employee perks…Flexible Ways of Working:Design your workday around what matters most. With flexible hours, you can balance work with all the other important things in life. And, with our Remote Work Arrangement, you can work from anywhere in the world for part of the year—whether that’s a beach in Bali or your cozy cabin in Muskoka.Health & Wellbeing Support:Your wellbeing is our priority. Enjoy fitness reimbursements, paramedical coverage, and a generous health spending account. Recharge with Embark Wellness Days and wellness‑focused afternoons, and access extended mental health support whenever you need it.Career Development That Moves You Forward:Fuel your growth with funding for courses, certifications, and conferences. Explore current horizons through job rotations and secondments, and benefit from ongoing coaching and personalized development planning that keeps your career moving. At Embark, people stick around for the long‑haul.RESP Matching — Because Futures Matter:We don’t just talk about education—we invest in it. On top of RRSP matching, you’ll receive RESP matching to help your loved ones pursue their post‑secondary dreams.Fun Is Part of the Job:We take fun seriously. From themed parties and surprise treat days to team socials that actually make you want to show up, we create moments that spark joy, build connection, and make work feel like more than just work.Recent Awards#J-18808-Ljbffr

📌 Cybersecurity Analyst - $115,000 - $138,000 A Year (Winnipeg)
🏢 Embark
📍 Winnipeg