About AlphaSense:
AlphaSense is the AI platform redefining market intelligence and workflow orchestration, trusted by thousands of leading organizations to drive faster, more confident decisions in business and finance. The platform combines domain-specific AI with a vast content universe of over 500 million premium business documents — including equity research, earnings calls, expert interviews, filings, news, and internal proprietary content. Purpose-built for speed, accuracy, and enterprise-grade security, AlphaSense helps teams extract critical insights, uncover market-moving trends, and automate complex workflows with high-quality outputs. With AI solutions like Generative Search, Generative Grid, and Deep Research, AlphaSense delivers the clarity and depth professionals need to navigate complexity and obtain accurate, real-time information quickly. For more information, visit www.alpha-sense.com . Come join us.
Remote within Canada, able to work in the Pacific time zone
ABOUT THE ROLE
We are hiring Security Operations Analyst II to join our Security Operations team in a fully remote capacity from Canada. This role sits at Tier 1–2 in our operating model — you are past the stage of learning what alerts look like and ready to own triage, perform structured investigations, and contribute to detection quality. You will handle the day-to-day alert queue, investigate escalated or ambiguous cases, handle incidents and work closely with senior analysts and the Security Operations Manager to close coverage gaps.
We expect you to think analytically, document thoroughly, and operate with growing independence. You will be supported by experienced colleagues and a mature toolset, but you are expected to bring real investigative instinct and a curiosity to grow to the role from day one.
WHAT YOU WILL DO
Alert Triage & Investigation
Monitor and triage alerts across endpoint, network, cloud, runtime and identity data sources with accuracy and appropriate urgency
Perform structured investigations on escalated or ambiguous alerts: pivot across log sources, correlate events, and build a coherent timeline
Classify alerts correctly — true positive, false positive, or benign — with documented rationale, not just a verdict
Identify scope and blast radius on confirmed incidents: affected users, systems, and data before escalating or containing
Escalate to senior analysts with a complete investigation package — context, evidence, timeline, and a hypothesis
Incident Response Support
Participate in active incident response under senior analyst or manager direction: evidence collection, log pulls, timeline reconstruction
Execute containment actions — endpoint isolation, account suspension, token revocation — as directed with documented rationale
Maintain accurate and timely case documentation throughout the incident lifecycle
Contribute to post-incident timelines and assist with root cause documentation
Cloud & Identity Security Monitoring
Monitor cloud audit logs and native threat detection findings for suspicious IAM activity, unusual API calls, and access anomalies
Investigate identity provider events: suspicious logins, MFA bypass attempts, session anomalies, and unauthorized app assignments
Recognize common cloud-native attack patterns: credential abuse via metadata service, privilege escalation via IAM role assumption, and storage misconfiguration access
Correlate cloud-side events with endpoint and network telemetry to build a fuller picture of attacker activity
Detection & Quality Improvement
Flag false positives and noisy detections with enough context for a senior analyst or detection engineer to tune them
Identify gaps in existing detection coverage based on alert patterns you observe during triage
Apply knowledge of MITRE ATT&CK to label attacker techniques and communicate findings consistently
Contribute to runbook accuracy by flagging outdated steps or missing guidance encountered during investigations
Participate with Detections…