More jobs:
Job Description & How to Apply Below
At EY, we’re all in to shape your future with confidence.
We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go.
Join EY and help to build a better working world.
The opportunity
Ernst & Young is seeking junior and intermediate-level technical security professionals with hands‑on expertise in Microsoft Sentinel and Microsoft Defender to support our Managed Detection and Response (MDR) services within a Security Operations Center (SOC) environment.
This role is designed for an experienced Tier 1 / Tier 2 SOC Analyst who performs threat detection, investigation, and response activities. The successful candidate will operate in a client‑facing MSSP environment and will contribute directly to the quality, effectiveness, and continuous improvement of EY’s MDR services.
This job posting relates to an existing vacancy within our organization.
Your key responsibilities:
Working with our technical team and clients the candidate will be responsible for:
Security Monitoring and Incident Response
Perform security monitoring, triage, and investigation of alerts generated from Microsoft Sentinel and Microsoft Defender platforms using documented playbooks.
Escalate confirmed or complex incidents, including suspected compromise, lateral movement, persistence mechanisms, and data exfiltration scenarios.
Perform investigations using log analytics, endpoint telemetry, identity signals, and cloud‑native audit logs.
Validate, scope, and document security incidents, including root cause analysis and impact assessment.
Assist with containment and recovery under senior guidance.
Detection Engineering and Use Case Development
Support tuning and maintenance of Sentinel analytics rules.
Assist with false positive reduction and improving signal quality across Sentinel and Defender data sources.
Document detection gaps
Contribute to use case development under guidance to enhance detections, hunting queries, and alert enrichment.
Threat Hunting
Support threat hunting activities
Identify anomalous or suspicious activity that may not trigger existing detections.
Document hunting hypotheses, findings, and recommendations for detection improvements or control gaps.
Client Engagement and Technical Advisory
Communicating incident findings clearly
Participating in client calls when required
Supporting onboarding and steady‑state operations
Support senior team members in identifying logging, configuration improvements.
Support onboarding and steady‑state operations for MDR clients within a managed services context.
Operational Excellence
Contribute to playbooks and procedural improvements.
Participate in knowledge sharing and case reviews.
Assist with service quality improvements, detection maturity, and operational consistency across clients.
Ensure investigations and responses align with applicable regulatory, contractual, and evidentiary requirements.
Key Requirements:
Proven experience operating in a SOC or MSSP environment at a Tier 1 or Tier 2 level.
Hands‑on expertise with Microsoft Sentinel, including analytics rules, KQL, workbooks, and incident investigations.
Experience with Microsoft Defender technologies, including Defender for Endpoint and identity‑related signals.
Exposure to investigations across cloud, endpoint, and identity domains.
Working understanding of attack techniques, threat actor behaviors, and incident response methodologies.
Ability to manage multiple investigations simultaneously while maintaining investigation quality and documentation.
Strong written and verbal communication skills, with the ability to explain technical findings to security‑focused audiences.
Proficiency in French, including Quebec French, is desired for client facing engagements.
Qualifications:
Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.
Relevant certifications such as:
Microsoft Certified:
Azure Security Engineer Associate
Microsoft Sentinel specialization
CISSP, GCED, GCIA, or similar (preferred, not required)
Minimum 1-2 years of experience in cybersecurity operations, with significant time spent in incident response and security monitoring…
To View & Apply for jobs on this site that accept applications from your location or country, tap the button below to make a Search.
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).
Search for further Jobs Here:
×