F12 | Security Operations Analyst

POSITION: Security Operations Analyst – Red Team

JOB TYPE: Full Time

LOCATION: Regional Centers (Edmonton, Markham)

REPORTS TO: IT & Compliance Manager

Who We Are:

We built by uniting IT consulting firms from across Canada around a common vision - to combat risk and complexity by continuously crafting business technology platforms that empower business leaders to focus and thrive. We aim to elevate IT conversations (from ingredients to outcomes) and deliver fully designed solutions where there are no bad options.

General Description:

Look no further if you seek the fast lane into an IT career or wish to supercharge your professional development. You will collaborate with a diverse team and gain exposure to technology services in scores of businesses; your resume will become rich with experience and accomplishments. F12 is on a mission to elevate our employees. We are doing this by building and retaining an elite team of IT professionals equipped to deliver unmatched service to Canadian business leaders and their teams. We value humble service, self-improvement, hard work, and we are looking for like-minded individuals to join us on our journey.

The Purpose:

The Security Operations Analyst – Red Team role is one where we look to build a rich and capable team of offensive security professionals to deliver security assessment and penetration testing services to the SMB market. This is primarily a red team position: the successful candidate will spend the majority of their time planning and executing penetration tests, vulnerability assessments, and adversarial simulations against internal and external customer environments across IT and OT. While offensive security is the primary focus, analysts are expected to maintain working blue team knowledge — familiarity with SOC operations, security monitoring, and incident detection and response — so that engagements are realistic, well-informed, and directly useful in strengthening customers' defensive posture. Time management and in-depth knowledge of internal and external products and services are imperative to success.

The analyst will apply their skills and knowledge in the day-to-day execution of offensive security activities including, but not limited to, planning, performing, and presenting security assessments, penetration tests, and red team engagements across IT and OT environments; identifying and exploiting vulnerabilities using a variety of proprietary and third-party tools and techniques; and delivering clear, actionable reporting to internal and external stakeholders. The analyst will also draw on blue team fundamentals — including analysis of security logs and systems data, familiarity with SOC tooling (SIEM, IDS/IPS, DLP, EDR, and threat intelligence platforms), and incident response processes — to design realistic attack scenarios and to support the SOC when needed. The ideal candidate has experience not only using a wide range of offensive security tools and methodologies, but also diligent upkeep and continuous improvement of penetration testing and security assessment processes.

Responsibilities — Red Team / Offensive Security (Primary):

• Plan, scope, and independently execute penetration tests, vulnerability assessments, and red team engagements across IT and OT environments for internal and external customers.
• Apply investigative tactics, techniques, and procedures (TTPs) to simulate real-world adversaries and identify exploitable weaknesses in customer networks, systems, and applications.
• Conduct network, web application, wireless, and social engineering penetration tests using a variety of proprietary and third-party tools.
• Identify, exploit, and document vulnerabilities, providing clear risk ratings, evidence, and remediation guidance.
• Prepare and present formal security assessment and penetration test reports to clients, executive stakeholders, and technical teams.
• Perform threat hunting independently to proactively identify indicators of compromise and attacker activity.
• Participate in purple team exercises, collaborating with blue team/SOC staff to validate and improve detection and response capabilities.
• Stay current on emerging threats, attacker TTPs, exploit techniques, and offensive security tooling.
• Support special security and compliance requirements of external parties (e.g., penetration testing components of PCI DSS, SOC 2, and similar frameworks).
• Participate in internal projects and initiatives to improve security assessment methodology and SOC tooling.

Responsibilities — Blue Team / SOC Support (Secondary):

• Maintain working knowledge of security monitoring, log analysis, and SOC operations to inform realistic, well-grounded assessments.
• Analyze security logs and systems data to identify anomalous or irregular events when supporting SOC investigations.
• Contribute to incident response investigations, digital forensics (network, endpoint, log), and after-action reviews as needed.
• Support and mentor SOC analysts during investigations or customer inquiries.
• Document incident response workflow and maintain chain of custody for collected evidence when involved in incident response.
• Identify gaps in processes and procedures and escalate them to the appropriate teams.
• Provide input to the Learning and Development team on training content.
• Ensure security operations duties are executed in accordance with security policies, procedures, and third-party or compliance obligations.

Requirements/Qualifications:

• 3+ years' experience in penetration testing, red teaming, or security assessments, with a solid understanding of network topology, network security, and internet/intranet/extranet technologies and operating systems.
• A bachelor's degree in Computer Science, Computer Engineering, or Electrical Engineering with a focus in Information Technology.
• Education: practical, relevant work experience in a related area (Cybersecurity) accepted instead of a university degree.
• Offensive security certifications such as OSCP, GPEN, GWAPT, CEH, or PenTest+ are strongly preferred.
• Defensive/blue team certifications such as Security+, CySA+, or GCIH are an asset.
• Solid understanding of common attack frameworks (e.g., MITRE ATT&CK) and familiarity with information security vulnerabilities and risk management.
• Working knowledge of blue team concepts — SIEM, log analysis, incident detection and response — sufficient to inform realistic offensive engagements and collaborate effectively with SOC teams.
• Demonstrated leadership or initiative at school, work, and/or in the community (extracurricular activities).
• Growth mindset, with a passion for learning.
• Collaborative, with an ability to cultivate relationships and networks.
• Agile, technically savvy, with a knack for creating solutions.
• Creative thinker with a unique ability for resourcefulness.
• Strong analytical and organizational skills, effective written and verbal communication skills, and team-oriented.
• A high level of personal skills is required to make formal, persuasive presentations to groups and to deal effectively with people from all segments of the community.

The above statements are intended to describe the general nature and level of work performed by people assigned to this job classification. They are not intended to be an exhaustive list of all responsibilities and duties required of people assigned to this job classification.