Job DescriptionJob DescriptionSalary: $65,000
About Zedcor Inc.
Zedcor Inc. (TSX-V:ZDC) is disrupting the traditional physical security industry through its proprietary MobileyeZ security towers by providing turnkey and customized mobile surveillance and live monitoring solutions to blue-chip customers across North America. The Company continues to expand its established platform of MobileyeZ towers in Canada and the United States, with emphasis on industry leading service levels, data-supported efficiency outcomes, and continued innovation. Zedcor services the Canadian market through equipment and service centers currently located in British Columbia, Alberta, Manitoba, and Ontario. The Company continues to advance its U.S. expansion which now has the capacity to service markets throughout the Midwest with locations throughout Texas, Colorado, Arizona, Nevada and Florida.
For more information, check out www.zedcor.com.
Position Overview
The Security Analyst is responsible for ensuring that the organizations security logs, alerts, and telemetry are properly collected, monitored, routed, and maintained across the enterprise. The primary focus of this role is Microsoft Sentinel SIEM operations, log ingestion health, alert collection, alert rule validation, and monitoring coverage across all systems and devices.This role ensures that logs and alerts from Windows, Linux, Azure, Microsoft 365, Exchange, Microsoft Purview, Tenable Vulnerability Management, Arctic Wolf, firewalls, switches, routers, modems, cameras, IoT devices, servers, endpoints, and cloud services are properly collected and available for security monitoring. The Security Analyst is responsible for identifying logging gaps, resolving ingestion issues, creating and tuning alert rules, validating security feeds, and ensuring that the SIEM provides accurate visibility into the environment.
Key Responsibilities
SIEM, Log Collection, and Alert CollectionOperate and maintain Microsoft Sentinel as the organizations primary SIEM platform.Ensure all required security logs are being collected by Microsoft Sentinel.Ensure all required security alerts are being collected, routed, and visible in Sentinel and other approved monitoring platforms.Monitor Sentinel data connectors, agents, ingestion pipelines, parsers, workbooks, analytic rules, and incident creation.Validate that logs and alerts are collected from all approved sources, including endpoints, servers, cloud platforms, network devices, IoT devices, cameras, and security tools.Troubleshoot and resolve log ingestion failures, connector issues, parser errors, agent failures, missing data, delayed logs, and alert routing issues.Ensure logs are continuously collected, retained, searchable, and usable for investigation.Identify systems, devices, applications, or security tools that are not logging properly.Track logging and alerting gaps through remediation.Maintain an inventory of log sources, alert sources, collection methods, data connectors, and monitoring coverage.Microsoft Sentinel AdministrationConfigure, validate, and maintain Microsoft Sentinel data connectors.Create, tune, and maintain Sentinel analytics rules, alert rules, incidents, workbooks, dashboards, watchlists, and automation rules.Use KQL to validate log ingestion, review alert data, investigate anomalies, and support threat hunting.Ensure Sentinel alert rules are accurate, actionable, and aligned with organizational risk.Validate that alert rules generate incidents correctly and route to the proper monitoring or response process.Review Sentinel health, usage, ingestion volume, and data source coverage.Tune noisy or low-value alert rules while preserving required detection coverage.Document Sentinel configurations, alert logic, ingestion sources, and operational procedures.Windows and Linux Log CollectionEnsure Windows and Linux systems are properly configured to send logs to Microsoft Sentinel and related monitoring platforms.Validate Windows Event Logs, Security logs, System logs, Application logs, PowerShell logs, Sysmon logs, authentication events, process execution events, administrative activity, and audit policy events.Validate Linux authentication logs, sudo activity, SSH activity, auditd logs, syslog, cron activity, daemon logs, privilege escalation events, and system activity.Troubleshoot Windows and Linux logging agents, connectors, forwarding rules, and audit configurations.Work with IT teams to adjust Windows and Linux audit policies so the correct events are captured.Ensure server and endpoint logging remains active after system updates, rebuilds, configuration changes, or new deployments.Microsoft Azure, Microsoft 365, Exchange, and Purview LoggingEnsure Azure, Microsoft 365, Entra ID, Exchange, Defender, and Purview logs are properly collected and monitored.Validate collection of Azure activity logs, sign-in logs, audit logs, identity events, privileged activity, resource changes, and security alerts.Validate Microsoft 365 and Exchange logs, including mailbox access, mail flow, phishing activity, suspicious inbox rules, transport rule changes, administrative changes, and abnormal user activity.Validate Microsoft Purview audit, compliance, data protection, DLP, sensitivity label, retention, and insider risk events where applicable.Ensure Microsoft cloud logs are routed to Sentinel, Arctic Wolf, or other approved monitoring destinations as required.Identify and remediate gaps in Microsoft cloud logging and alert collection.Tenable Vulnerability Management Alert and Data CollectionEnsure Tenable Vulnerability Management scan results, findings, alerts, asset data, and risk information are available to the appropriate security monitoring and reporting processes.Validate that Tenable scans are running and producing usable vulnerability data.Ensure critical Tenable findings and vulnerability alerts are routed to the correct dashboards, reports, tickets, or monitoring workflows.Identify assets that are missing from Tenable scans or not reporting vulnerability data.Coordinate with IT teams to resolve Tenable data collection, scan coverage, credential, or agent issues.Support vulnerability reporting by validating that Tenable data is complete, current, and usable.Arctic Wolf Feed and Alert CoordinationEnsure required logs, feeds, and alerts are properly forwarding to Arctic Wolf.Validate that Arctic Wolf is receiving the correct security data from Sentinel, Microsoft cloud services, endpoints, servers, network devices, and security tools.Coordinate with Arctic Wolf to resolve feed failures, missing logs, alert routing issues, and monitoring coverage gaps.Confirm Arctic Wolf is monitoring the correct alert sources and escalation paths.Review Arctic Wolf notifications and findings to validate data quality and monitoring effectiveness.Ensure alignment between Sentinel alert collection and Arctic Wolf monitoring coverage.Network, IoT, Camera, and Infrastructure Log CollectionEnsure logs and alerts are collected from infrastructure and connected devices, including:FirewallsSwitchesRoutersModemsWireless access pointsVPN appliancesCameras and video surveillance systemsIoT devicesPrinters and peripheral devicesWindows servers and endpointsLinux servers and endpointsCloud and SaaS platformsValidate syslog, SNMP, API-based logging, agent-based logging, and connector-based log collection.Work with IT teams to correct device logging configurations and forwarding rules.Identify infrastructure devices that are not logging, not forwarding alerts, or not visible in the SIEM.Ensure newly deployed systems and devices are added to the log collection and alert monitoring inventory.SOAR and Automated Alert HandlingConfigure and maintain SOAR playbooks related to alert handling, enrichment, routing, notification, ticket creation, and escalation.Support automated response workflows for approved use cases.Validate that automated actions trigger from the correct Sentinel alerts and incidents.Test SOAR workflows to ensure they are accurate, safe, and documented.Document automation logic, escalation paths, approval requirements, and exception handling.Threat Hunting and Alert ValidationUse Sentinel, KQL, Arctic Wolf findings, Microsoft Defender alerts, Tenable findings, and collected logs to identify suspicious activity.Perform routine checks to confirm alerts are firing correctly and logs are available for investigation.Hunt for suspicious authentication, malware, lateral movement, privilege escalation, persistence, command-and-control, data exfiltration, and abnormal system behavior.Validate that detections are supported by complete and reliable log data.Escalate confirmed threats, critical alerts, and unresolved logging gaps to the Head of Cybersecurity.Documentation, Reporting, and Operational MetricsMaintain documentation for log sources, alert sources, data connectors, collection methods, SIEM rules, SOAR playbooks, and monitoring coverage.Maintain a log and alert coverage matrix showing which systems are logging, what alerts are collected, and where data is monitored.Produce recurring reports on:Sentinel ingestion healthLog source availabilityAlert source availabilityMissing or delayed logsConnector and agent healthAlert rule statusTenable data collection statusArctic Wolf feed statusMicrosoft cloud logging statusNetwork and IoT device logging statusUnresolved monitoring gapsSupport audits, compliance reviews, cyber insurance requests, and internal risk reviews by providing evidence of log collection and alert monitoring.
Qualifications
Experience with Microsoft Sentinel or another SIEM platform.Experience with log collection, alert collection, SIEM monitoring, and security event analysis.Working knowledge of Windows and Linux operating systems.Experience reviewing and troubleshooting Windows Event Logs, Linux system logs, syslog, authentication logs, and security audit logs.Familiarity with Microsoft Azure, Microsoft 365, Exchange, Entra ID, Microsoft Defender, and Microsoft Purview logging.Familiarity with vulnerability management tools such as Tenable, Nessus, Qualys, Rapid7, or similar.Ability to troubleshoot data connectors, logging agents, syslog forwarding, API integrations, audit policies, and alert routing.Basic understanding of firewalls, switches, routers, modems, wireless networks, servers, endpoints, cloud systems, cameras, and IoT devices.Ability to create, review, validate, and tune SIEM alert rules.Strong analytical, documentation, and problem-solving skills.
Why Join Zedcor?
At Zedcor, you wont just maintain systems, youll help build and shape the future of security technology. We provide the tools, mentorship, and the environment to help you thrive and grow in your technical career. If youre looking to take your skills to the next level, Zedcor offers a dynamic and rewarding opportunity.
Zedcor Inc. is an Equal Opportunity Employer and maintains the policy of recruiting and retaining the best-qualified personnel who demonstrate the ability to perform competently and work well with others. It is the policy of Zedcor to provide equal employment opportunity regardless of race (including traits historically or culturally associated with race, such as hair texture and protective hairstyles), religion (including religious dress and religious grooming), color, age (40 and over), genetic information, disability (mental and physical), medical condition (as defined under state law), national origin (including language use restrictions and possession of a drivers license issued under section 12801.9 of the California Vehicle Code), ancestry, sex (including gender, gender identity, gender expression), sexual orientation, marital status, familial status, parental status, domestic partner status, citizenship status, pregnancy (including perceived pregnancy, childbirth, lactation, or pregnancy-related conditions), military caregiver status, military status, veteran status, or any other status protected by federal, state, or local law. This policy of nondiscrimination is applied to all aspects of the employment relationship. The Company complies with the Americans with Disabilities Act (ADA) and applicable state and local laws in ensuring equal opportunity and employment for qualified persons with disabilities. We also consider qualified applicants with criminal histories, consistent with legal requirements.
The following link provides more information regarding the Federal laws prohibiting discrimination in employment:EEO is the Law Notice of Applicant Rights Under the Law.
Read Less
