Monitor Microsoft Sentinel alerts at Office Ally, using incident triage and KQL to investigate threats across security platforms. This hands-on role includes up to 5% travel.

The Security Operations Analyst serves as the first defense line for Office Ally’s security program. You will investigate incidents across endpoint, identity, email, and data protection platforms. The role partners with security engineering, cloud infrastructure, and IT operations while maintaining compliance audit records.

Key Responsibilities:

- Monitor, triage, document, close, or escalate security incidents
- Investigate endpoint alerts using timelines, process trees, and file events
- Run KQL hunting queries for indicators of compromise




- Review sign-in logs and Conditional Access results
- Maintain SOC runbooks and incident response procedures

Requirements:

- Two or more years in SOC, IT security, or incident response
- Microsoft Sentinel and Microsoft Defender suite knowledge
- Ability to read and write KQL hunting queries
- Active Directory and Entra ID fundamentals
- Knowledge of SOC 2, HIPAA, or HITRUST requirements

Apply security operations expertise in Microsoft Sentinel, KQL hunting, identity monitoring, and incident documentation at Office Ally.

📌 Security Operations Analyst Microsoft Sentinel (Vancouver)
🏢 Office Ally
📍 Vancouver