Monitor Microsoft Sentinel alerts at Office Ally, using incident triage and KQL to investigate threats across security platforms. This hands-on role includes up to 5% travel.

The Security Operations Analyst serves as the first defense line for Office Ally’s security program. You will investigate incidents across endpoint, identity, email, and data protection platforms. The role partners with security engineering, cloud infrastructure, and IT operations while maintaining compliance audit records.

Key Responsibilities

Monitor, triage, document, close, or escalate security incidents

Investigate endpoint alerts using timelines, process trees, and file events

Run KQL hunting queries for indicators of compromise

Review sign-in logs and Conditional Access results

Maintain SOC runbooks and incident response procedures

Requirements

Two or more years in SOC, IT security, or incident response

Microsoft Sentinel and Microsoft Defender suite knowledge

Ability to read and write KQL hunting queries

Active Directory and Entra ID fundamentals

Knowledge of SOC 2, HIPAA, or HITRUST requirements

Apply security operations expertise in Microsoft Sentinel, KQL hunting, identity monitoring, and incident documentation at Office Ally.

📌 Security Operations Analyst Microsoft Sentinel (Winnipeg)
🏢 Office Ally
📍 Winnipeg