Cybersecurity Analyst II (Computer Systems Analyst II)

Job summary

Investigate escalated cybersecurity alerts and incidents by analyzing and correlating endpoint, identity, cloud, network, and application telemetry, and support containment, eradication, and recovery. Conduct threat hunting, tune detection rules, document findings and evidence, develop procedures and playbooks, and provide technical guidance to Tier 1 analysts.

Job details

Office of the Chief Information Officer | Government of Newfoundland and Labrador The Office of the Chief Information Officer (OCIO) provides professional information technology and information management/protection capabilities to support the business of government and the citizens of Newfoundland and Labrador. Responsibilities include IT and IM/IP coordination, planning, budgeting and policy development; development and operation of government computer systems and infrastructure; procurement of IT goods and services; management of IT-related agreements and contracts; and administration of the Management of Information Act. The Office of the Chief Information Officer is seeking a Cyber Security Analyst II (Tier 2 Security Analyst) to join its Cyber Security Operations team. The successful candidate will conduct advanced security analysis, incident response, threat hunting and monitoring using Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID, Microsoft Azure, Microsoft 365 and other enterprise security technologies. The analyst will investigate escalated alerts and incidents; correlate endpoint, identity, cloud, network and application telemetry; determine scope and impact; and support containment, eradication and recovery. Responsibilities include advanced log analysis and Kusto Query Language (KQL) queries; technical investigations and threat hunting; analysis of device timelines and identity signals; documentation of findings and recommendations; development and tuning of detection rules; vulnerability assessment and remediation support; maintenance of incident records and evidence integrity; preparation of procedures and playbooks; and technical guidance to Tier 1 analysts. The successful candidate will collaborate with senior analysts, technical teams and business stakeholders and participate in on-call incident response when required. Other related duties as required. Screening Criteria Completion of a degree or diploma in Information Technology, Computer Science, Cybersecurity or a related discipline. Equivalencies will be considered. Experience investigating cybersecurity alerts, incidents or threats in an enterprise environment. Experience using security technologies such as SIEM, EDR, Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra ID or comparable platforms. Experience analyzing logs and security telemetry to identify threats, vulnerabilities, scope, and impact. Experience supporting incident containment, remediation, recovery, or post-incident activities. Experience with cloud security, threat hunting, digital forensics, malware analysis, KQL or a relevant cybersecurity certification would be considered an asset. Assessment Criteria Knowledge of cybersecurity operations, threat detection, incident response, and evidence-handling principles. Knowledge of common cyber threats, attack techniques, security vulnerabilities, and mitigation practices. Knowledge of enterprise identity, endpoint, cloud, network, and application security technologies. Ability to analyze complex technical information and solve problems. Ability to make sound and timely decisions during cybersecurity investigations. Ability to manage time, priorities, and multiple concurrent tasks. Ability to collaborate effectively as part of a multidisciplinary team. Ability to communicate effectively, both verbally and in writing. Client service orientation. Conditions of Employment Conditions of Offer Recent and satisfactory enhanced security clearance. Conditions of Acceptance Willingness to participate in 24-7-365 on-call availability and respond on short notice. Information for Applicants For more information about this opportunity please contact Michael Pelley, Manager of Cybersecurity Operations at MPelley@gov.nl.ca.

What you’ll do

Investigate escalated cybersecurity alerts and incidents by analyzing and correlating endpoint, identity, cloud, network, and application telemetry, and support containment, eradication, and recovery. Conduct threat hunting, tune detection rules, document findings and evidence, develop procedures and playbooks, and provide technical guidance to Tier 1 analysts.

Requirements

A degree or diploma in information technology, computer science, cybersecurity, or a related discipline is required, with equivalencies considered. Candidates need enterprise experience investigating security alerts or incidents, using SIEM or EDR platforms, analyzing security telemetry, and supporting incident response; cloud security, threat hunting, forensics, malware analysis, KQL, or relevant certifications are assets.

Listed skills

• Microsoft Azure · Preferred
• Microsoft 365 · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• Cybersecurity Operations
• Incident Response
• Threat Hunting
• Security Monitoring
• Log Analysis
• Kusto Query Language
• Microsoft Sentinel
• Microsoft Defender XDR
• Microsoft Entra ID
• Microsoft Azure
• Microsoft 365
• Digital Forensics
• Vulnerability Assessment
• Detection Rule Tuning
• Evidence Handling
• Technical Communication

Job areas

• Security & Safety
• Technology
• Government & Public Sector