Senior Analyst - Security Operations and Assurance

Technology Services

Technology Services (TS) is responsible for delivering all enterprise infrastructure, applications and related end user technology services across all Brookfield business groups.

Brookfield Place - 181 Bay Street

Technology Services (TS) is responsible for delivering all enterprise infrastructure, applications and related end user technology services across all Brookfield business groups.

Brookfield has a unique and dynamic culture. We seek team members who have a long-term focus and whose values align with our Attributes of a Brookfield Leader:
Entrepreneurial, Collaborative and Disciplined. Brookfield is committed to the development of our people through challenging work assignments and exposure to diverse businesses.

The Senior Security Analyst - Security Operations & Assurance is a senior security generalist responsible for supporting day-to-day security operations and responding flexibly to evolving business and security priorities. The role leads the investigation and resolution of complex security alerts and incidents while providing hands-on administration and support across Zscaler, email security, Microsoft security platforms, identity and access controls, vulnerability management, security awareness, third-party risk, legal hold and eDiscovery, policy implementation, and security technology operations.

The Senior Analyst exercises sound judgment, works independently, and moves effectively between operational incidents, control reviews, stakeholder requests, and security improvement initiatives.

• Investigate and respond to security alerts from Microsoft Sentinel, Microsoft Defender XDR, endpoint security tools, and other monitoring platforms; gather evidence, review logs, coordinate containment, and document findings through resolution.
• Manage security incidents, approvals, and service requests in Service Now; maintain queue health, ensure timely triage, resolve complex escalations, and provide clear stakeholder communication.
• Manage the security mailbox independently; investigate user-reported security concerns, coordinate required actions, identify recurring issues, and elevate significant matters.
• Administer Zscaler Internet Access, Zscaler Private Access, and Zscaler Client Connector; investigate connectivity, authentication, policy-enforcement, web-access, and application-access issues.
• Review Zscaler web, firewall, DNS, and access logs and implement approved changes involving URL filtering, cloud application controls, SSL/TLS inspection, data protection, remote access, and business exceptions.
• Administer email-security controls across Microsoft Defender for Office 365, Exchange Online, and Abnormal Security; investigate phishing, spoofing, executive impersonation, malicious links, business email compromise, and account compromise.
• Perform message tracing, quarantine review, tenant allow/block administration, false-positive analysis, phishing-submission review, policy tuning, and investigation of SPF, DKIM, and DMARC failures.
• Administer assigned Microsoft security platforms, including Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra , and Microsoft Purview, using least-privilege and formal change-management practices.
• Support the secure adoption and operation of approved artificial intelligence and generative AI services; review AI applications, agents, connectors, integrations, and use cases for security, privacy, identity, data-protection, retention, and third-party risks.
• Administer and monitor security controls governing access to AI applications, including Zscaler cloud application controls, data loss prevention, identity controls, application restrictions, and approved business exceptions.
• Identify and investigate unauthorized or shadow AI usage and AI-related security events, including sensitive-data disclosure, malicious uploads, account compromise, prompt injection, insecure integrations, excessive permissions, and unsafe automated actions.
• Use approved AI-enabled security capabilities to improve investigation, detection, vulnerability analysis, reporting, and workflow automation while validating outputs and protecting sensitive information.
• Review and maintain Conditional Access, multifactor authentication, privileged access, role-based access control, and access-review configurations; validate changes against least-privilege principles and approved access requirements.
• Operate the enterprise…