Job Description

Insight Global is looking for a hands‑on Cyber Security Analyst to join a growing security team. This individual will play a key role in day‑to‑day security operations, incident response, MDR provider management, and the continued maturation of the organization's security program.

The successful candidate will have a strong SOC / incident response background and hands‑on experience within the Microsoft security ecosystem, including Defender, Azure, Sentinel, Entra ID, and Intune. This person should be comfortable taking ownership of security incidents, working with an outsourced MDR provider, identifying gaps in monitoring and tooling, and helping move the security practice toward a more mature future state.

This is not a governance‑focused role. The ideal candidate is technically curious, accountable, and capable of looking beyond individual tickets to identify opportunities to improve the overall security environment.

Key Responsibilities

Incident Response & Security Operations

- Own and manage the Tier 2 security incident queue, including triage, prioritization, investigation, containment, and closure.
- Manage approximately 5–7 day‑to‑day security tickets/incidents, while using additional capacity to improve SOC processes and security capabilities.
- Act as an escalation point for alerts generated by the MDR provider and internal service desk.
- Determine the validity and business impact of security incidents and escalated critical issues appropriately.
- Coordinate containment activities with IT and infrastructure teams, including account disabling, endpoint isolation and blocking.
- Maintain clear incident documentation, response playbooks and operational metrics.




- Identify gaps in monitoring, alerting and incident‑response processes and recommend improvements.

MDR / MSSP Management

- Act as the day‑to‑day technical contact for the organization's Managed Detection and Response (MDR) provider.
- Review and challenge MDR escalations to ensure alerts are actionable and meet agreed‑upon SLAs.
- Track MDR recommendations and incidents through resolution.
- Validate monitoring and tooling coverage across endpoints, network, cloud and applications.
- Help measure MDR performance and identify opportunities to mature the relationship and security practice.

Microsoft Security & Cloud

- Work hands‑on across the Microsoft security ecosystem, including:
- Microsoft Defender XDR
- Microsoft Sentinel
- Microsoft Entra ID
- Microsoft Intune
- Microsoft Purview / DLP Azure security tooling
- Perform security investigations, alert analysis and threat hunting.
- Review risky sign‑ins, device compliance, endpoint activity and cloud security events.
- Support Sentinel capabilities including data connectors, analytics rules, workbooks and KQL‑based investigations.
- Assist with the organization's continued consolidation and maturation of its Microsoft security environment.

Application Security & DevSecOps





- Partner with infrastructure and application‑development teams to ensure sufficient security monitoring exists across both infrastructure and application layers.
- Understand differences in security monitoring requirements across technologies such as Linux, .NET and WordPress applications.
- Review security requirements for Azure‑hosted workloads and web applications.
- Support secure software‑development practices such as code scanning, dependency scanning, secrets management and application logging.
- Help identify gaps in application‑layer monitoring and recommend appropriate controls and alerts.
- Contribute to incident‑response playbooks for threats including phishing, compromised accounts, ransomware precursors and web application attacks.

We will use AI to search and screen candidates.

Skills and Requirements

- 2–3+ years of hands‑on cybersecurity experience, ideally within a SOC, enterprise security operations or incident‑response environment.
- Demonstrated experience investigating and responding to security incidents from initial alert through resolution.
- Experience working with an outsourced MDR or MSSP and handling security alerts/escalations.
- Robust foundational knowledge of the Microsoft security stack, particularly: Microsoft Defender Microsoft Sentinel Azure Entra ID Intune.
- Understanding of SIEM technologies and security monitoring concepts.
- Familiarity with KQL or similar security‑query languages.
- Understanding of endpoint, network, cloud and application security events.
- Exposure to application security and/or DevSecOps concepts, particularly security logging and monitoring.
- Ability to identify gaps in security tooling, monitoring or process

📌 Security Analyst, SOC (Toronto)
🏢 Insight Global (United States)
📍 Toronto