Security Incident Response Analyst

About the Role

We're looking for a senior individual contributor to join our Detection & Response team as a Security Incident Response Analyst. In this role, you'll serve as a senior-level investigator responsible for detecting, analyzing, and responding to advanced security threats across on-prem and cloud infrastructure in a multi-vendor environment. You'll lead investigations spanning phishing, malware, insider threats, and other complex security incidents — driving them from initial detection through containment, eradication, and recovery.

What You'll Do

• Lead end-to-end investigations into phishing, malware, insider threats, and other advanced security incidents
• Triage and analyze security alerts, distinguishing true threats from noise, and prioritize response based on risk and business impact.
• Perform technical malware analysis, including static and dynamic examination of suspicious files, to determine behavior, capability, and intent.
• Conduct host and network-based analysis — analyzing system logs, processes, registry/configuration artifacts, memory, traffic patterns, DNS activity, and connection logs — to reconstruct attacker activity and identify persistence, command-and-control, lateral movement, and data exfiltration.
• Investigate cloud-native incidents by analyzing audit logs, IAM and access activity, and network flow data to detect unauthorized access, privilege misuse, and malicious file activities across cloud environments.
• Drive incidents through containment, eradication, and recovery, coordinating with cross-functional teams as needed.
• Develop and refine detection logic, playbooks, and response procedures to improve the team's ability to identify and act on emerging threats.
• Act as an escalation point for the most technically complex cases, mentoring junior analysts.
• Document findings and communicate clearly with both technical and non-technical stakeholders, including post-incident reports and executive summaries.

What We're Looking For

• 5+ years of experience in Incident Response, DFIR, or Security Operations

• Experience leading significant security investigations

• Strong familiarity with cloud environments (AWS and/or GCP)

• Hands-on experience with SIEM, EDR, and log analysis

• Solid understanding of identity systems and distributed architectures

• Ability to stay composed and structured during high-pressure situations

• Clear written and verbal communication skills

Nice to Have

• Experience in large-scale consumer or SaaS environments

• Experience working across global teams

• Familiarity with privacy-related incident handling (e.g., GDPR)

• Scripting or automation experience (Python, etc.)

Why This Role Matters

• We operate global consumer platforms that handle sensitive user data. When incidents happen, the way we respond matters.

• This role plays a key part in containing impact, protecting user trust, and improving our overall response maturity.

• Generous vacation, flex days, professional development days
• RRSP matching, and employee stock purchase plan
• Professional development budget and unlimited access to Udemy from day one
• Match Group mentorship program
• Parental leave top up and fertility preservation benefits
• Extended health & dental benefits from day one
• Corporate ClassPass membership and other wellness benefits