Specialist - Cyber Operations

Location: Dorval

Belonging to Air Canada, is belonging to a Canadian symbol, Air Canada recently elected best airline in North America. Take off your career by joining our innovative and diverse team at the forefront of passenger air transport.

The Cyber Operations Specialist will work in an innovative and dynamic environment supporting one of the best airlines in North America. This position requires strong analytical skills, technical knowledge, and good judgment in dynamic and stressful situations.

The Cyber Security Operations Centre (CSOC) Specialist will play a key role in advanced monitoring activities, detection engineering, and incident response. The successful candidate will support the continuous improvement of detection capabilities and contribute to the protection of Air Canada’s systems, data, and customers.

The Cyber Security Operations Centre is the first line of defense for Air Canada and its customers.

This position reports to the Cyber Operations Manager.

Responsibilities

Manage, maintain, and optimize CSOC technologies, including the Security Information and Event Management (SIEM) system, SOAR technologies, and associated detection and response platforms.

Perform Digital Forensics and Incident Response (DFIR) and counter malicious activities using TTP and IOC (tactics, techniques, and procedures, and indicators of compromise).

Improve and update detection and response technologies to account for the evolving cyber threat landscape.

Act as an escalation point for Cybersecurity Analysts responding to incidents.

Create and maintain documentation, including root cause analysis, standard operating procedures, and incident response procedures.

Participate in initiatives to improve IT efficiency, customer experience, and cybersecurity posture.

Calculate and report key service level metrics that demonstrate the effectiveness of the CSOC.

Produce and contribute to threat intelligence related to observed threats.

Develop and communicate operational security objectives; support team alignment.

Collaborate with stakeholders to gather and analyze information during investigations.

Review and analyze data from multiple internal and external sources.

Communicate findings and make actionable recommendations.

Facilitate business analysis and technology integration efforts.

Promote detection use case development and monitoring processes.

Build relationships within the organization to support efforts to promote safety and reliability in operations.

Maintain knowledge of evolving threats, technologies, and security practices.

Qualifications

University degree, technical certification, or equivalent experience commensurate with the position.

At least 5 years of experience in IT, security operations, or cybersecurity within a large enterprise.

Excellent understanding of network protocols, data packet flow, TCP/UDP traffic, and security technologies including firewalls, intrusion prevention systems, proxy servers, application firewalls, and endpoint detection solutions.

Experience working in a 24/7 operational environment (shift work and on-call support may be required).

Strong analytical, problem-solving, and decision-making skills.

Ability to communicate effectively and collaborate with stakeholders at all levels of the company.

Ability to work effectively under pressure in constantly changing environments.

Ability to manage multiple priorities in a dynamic environment.

Commitment to continuous service improvement.

Experience troubleshooting, tuning, or improving detection technologies that have produced false positives or failed to detect planned activities.

Attention to detail: candidates will need  identify inconsistencies  and unclear technical requirements, exercise judgment to determine whether to challenge them,  ignore  them, or seek clarification on  guidelines .

Experience with threat detection platforms such as Microsoft Sentinel, Microsoft Defender for Endpoint, or Palo Alto Cortex XDR, including knowledge of older modules such as “Insight Offline Alert Collector”.

Experience operating both agent-based endpoint detection solutions and fully agentless, real-time endpoint detection systems.

Experience in developing and tuning…