21 hours ago
Toronto, CanadaSenior
Responsibilities
- Monitor and analyze security events and alerts from SIEM, EDR, SASE, and other sources.
- Lead security incident response, including investigation, containment, eradication, recovery, root cause analysis, and completion of corrective actions.
- Develop and maintain incident response plans, playbooks, procedures, detection rules, and threat use cases.
- Manage security tools and technologies and evaluate new tools to improve security operations.
- Develop automation scripts and workflows for security event enrichment and response using GCP services.
- Use GCP services for data processing, analysis, and enrichment, and manage infrastructure through Terraform.
- Conduct threat research and analysis and contribute to security systems architecture and security-control design.
- Coordinate with IT, Engineering, Legal, leadership, and other teams during incidents and communicate security risks.
- Mentor junior security analysts and engineers.
- Support security compliance, reporting, audits, and adherence to organizational security policies.
- Participate in an on-call rotation.
Requirements
- Bachelor of Science degree in Computer Science or a related field.
- At least 7 years of cybersecurity experience focused on incident response, or at least 3 years of security operations experience with hands-on SOAR and automation experience.
- Deep understanding of security concepts, principles, and technologies.
- Experience configuring and administering security monitoring tools such as SIEM and EDR.
- Experience leading and coordinating incident response processes and methodologies.
- Proficiency in scripting languages such as Python or Go.
- Experience with Infrastructure as Code using Terraform or Ansible, or a strong desire to learn.
- Experience with threat intelligence platforms and their use in security operations.
- Strong analytical, problem-solving, collaboration, communication, and interpersonal skills.
- Preferred qualifications include security certifications such as OffSec or GIAC, digital forensics experience, cloud security experience with AWS, Azure, or GCP, SOAR experience, networking and security knowledge, and security-community contributions.
Benefits
- One-year fixed-term employment arrangement.
- Canada-specific base salary range of $130,600–$170,000 CAD, exclusive of bonus, equity, and benefits.
- Toronto-area employees within 65 km of headquarters collaborate in-office Monday through Thursday and receive 10 or 20 flexible remote days per quarter depending on office distance.
- Remote-eligible roles may be based anywhere in Canada or the US, as specified by the posting.
- Reference and background checks are conducted before joining.
About League
League builds a healthcare experience platform used by payers, providers, and employers to deliver personalized navigation, engagement, and member services. The privately held company, founded in 2014 and headquartered in Toronto, licenses its platform and solutions to health plans and health systems; customers include Manulife, SCAN, Geisinger, Medibank, Baptist, and Shoppers Drug Mart. Its cloud platform supports HIPAA, SOC 2 Type II, GDPR, and HITRUST r2 compliance.