Security Operations Analyst

Who we are:

Financeit is a point-of-sale financing provider serving some of the largest home improvement and retail organizations in Canada. Our platform helps businesses close more sales by offering customers affordable monthly payment options for their next big home improvement, vehicle or retail purchase.

We are small enough that you can make an impact within the company and large enough to make an impact in the market. Financeit is a company where collaboration, inclusivity, fairness, and respect aren’t just ideas that get talked about, but are part of who we are. If such a workplace intrigues you, we hope you’ll join us.

About the role:

Reporting to the Vice President of Information Technology as the first hire on our Security Operations Centre (SOC) team, you will be responsible for threat detection, investigation and incident response across endpoint, cloud, identity and production environments across the Financeit business. 

In partnership with our cybersecurity team, you will handle escalated and complex investigations, build and maintain SOC detection content, and service as the main point of contact for confirmed security incidents. As this is a new team you will help establish the investigation standards, runbooks and working practices for the SOC team. 

With a focus on automation and AI tooling, you’ll help build and tune automated detection and response workflows, apply judgement to the output they produce, and develop detection coverage for AI-related threats. This is a hands-on and technical role with a growing team! 

What you'll be doing:

• Lead complex investigations, cloud/host forensics, and containment for high-severity incidents across endpoint, cloud, and SaaS environments; participate in an on-call rotation.
• Write, test, tune, and manage detection rules and response playbooks as code across EDR, cloud, and log analytics platforms, mapping coverage to MITRE ATT&CK.
• Conduct hypothesis-driven threat hunts and translate financial-sector threat intel and purple team findings into durable detections.
• Document attacker activity for executive briefings and regulatory reports, driving post-incident corrective actions with IT and engineering partners.
• Document and maintain investigation runbooks, operational data and case detail behind SOC metrics and reporting, and evidence of audit, assurance, and client security 
• Partner with cybersecurity function to align detection and response priorities with the organizations risk picture 
• Build and maintain automated response and enrichment playbooks within approved guardrails and evaluate new security tooling and automation