Security Operations Analyst II

About AlphaSense AlphaSense is the AI platform redefining market intelligence and workflow orchestration, trusted by thousands of leading organizations to drive faster, more confident decisions in business and finance. The platform combines domain-specific AI with a vast content universe of over 500 million premium business documents, including equity research, earnings calls, expert interviews, filings, news, and internal proprietary content. Purpose-built for speed, accuracy, and enterprise-grade security, AlphaSense helps teams extract critical insights, uncover market-moving trends, and automate complex workflows. Its AI solutions include Generative Search, Generative Grid, and Deep Research. For more information, visit www.alpha-sense.com . Remote within Canada, able to work in the Pacific time zone About the Role AlphaSense is hiring a Security Operations Analyst II to join its Security Operations team in a fully remote capacity from Canada. The role sits at Tier 1-2 in the operating model: you are past the stage of learning what alerts look like and ready to own triage, perform structured investigations, and contribute to detection quality. You will handle the day-to-day alert queue, investigate escalated or ambiguous cases, handle incidents, and work closely with senior analysts and the Security Operations Manager to close coverage gaps. You will think analytically, document thoroughly, and operate with growing independence, supported by experienced colleagues and a mature toolset, bringing real investigative instinct and curiosity to the role from day one. What You Will Do Alert Triage and Investigation Monitor and triage alerts across endpoint, network, cloud, runtime, and identity data sources with accuracy and appropriate urgency. Perform structured investigations on escalated or ambiguous alerts, pivoting across log sources, correlating events, and building a coherent timeline. Classify alerts correctly as true positive, false positive, or benign, with documented rationale. Identify scope and blast radius on confirmed incidents, including affected users, systems, and data, before escalating or containing. Escalate to senior analysts with a complete investigation package: context, evidence, timeline, and a hypothesis. Incident Response Support Participate in active incident response under senior analyst or manager direction, including evidence collection, log pulls, and timeline reconstruction. Execute containment actions, such as endpoint isolation, account suspension, and token revocation, as directed, with documented rationale. Maintain accurate and timely case documentation throughout the incident lifecycle, and contribute to post-incident timelines and root cause documentation. Cloud and Identity Security Monitoring Monitor cloud audit logs and native threat detection findings for suspicious IAM activity, unusual API calls, and access anomalies. Investigate identity provider events, including suspicious logins, MFA bypass attempts, session anomalies, and unauthorized app assignments. Recognize common cloud-native attack patterns, and correlate cloud events with endpoint and network telemetry. Detection and Quality Improvement Flag false positives and noisy detections with context for tuning, and identify gaps in detection coverage from alert patterns. Apply knowledge of MITRE ATT&CK to label attacker techniques and communicate findings consistently. Contribute to runbook accuracy, and work with Detection Engineers to build detections and automate activity. Documentation and Communication Write clear, concise case notes a colleague could pick up mid-investigation, and produce accurate shift handoff summaries. Communicate incident updates to the Security Operations Manager with enough clarity to brief upward. What We Are Looking For Required 2-4+ years of hands-on experience in a SOC or security operations role with direct alert triage responsibility. A solid understanding of the MITRE ATT&CK framework, used to label and communicate attacker behavior. Working knowledge of EDR tooling, SIEM-based investigation, and foundational network protocols such as TCP/IP, DNS, HTTP/S, and TLS. Exposure to cloud security monitoring, for example AWS or GCP, and experience investigating identity-based alerts in an enterprise identity provider such as Okta or Entra ID. Strong written communication, with accurate, structured, and useful case notes. Preferred Experience with next-generation EDR platforms such as CrowdStrike Falcon or SentinelOne, and hands-on SIEM experience with a cloud-native platform. Exposure to CSPM or cloud security tooling, and familiarity with AWS incident response fundamentals. Experience working alongside an MDR partner, and relevant certifications such as CompTIA CySA+, Security+, BTL1, or GCIH. Compensation Base compensation ranges are set for all roles based on function and level. The base compensation range for this role is $65,000 – $90,000 CAD. You may also be offered a performance-based bonus, equity, and a generous benefits program.