Security Technology Analyst

Date Posted: 10/06/2026

Req ID: 50456

Faculty/Division: Temerty Faculty of Medicine

Department: MedIT

Campus: St. George (Downtown Toronto)

Position Number: 00059989

Existing Vacancy: Yes

Description

About us

Home to over 40 departments and institutes, the University of Toronto's Temerty Faculty of Medicine lies at the heart of the Toronto Academic Health Science Network and is a global leader in ground-breaking research and education, spanning clinical medicine, basic science and the rehabilitation sciences sectors.

Your opportunity

MedIT provides information technology support for the Temerty Faculty of Medicine. Our mission is to partner and collaborate with clients, University, and third parties to determine value based, sustainable technology solutions that enable the Faculty to achieve its academic mission.

As Security Technology Analyst, you will be responsible for implementing, tuning, and scaling advanced security technologies and AI tools to protect Temerty Faculty of Medicine systems, data, teaching, research, and administrative activities. Working closely with the Manager, Information Security, you will monitor multifaceted security data streams, proactively neutralizing threats through coordinated incident response, vulnerability management, and supporting incident response investigation.

You will contribute to the secure and reliable operation of security technologies by working with vendor-specific platforms and tools such as firewalls, endpoint detection and response solutions, security information and event management systems, configuration and policy management systems, vulnerability management platforms, AI tools, and identity and access management technologies.

You will prepare technical evidence and reporting, automate repeatable workflows, execute approved remediation activities, and collaborating cross-functionally with IT and University security teams to reduce risk and strengthen security operations.

Your responsibilities will include

Configure, tune, troubleshoot, and maintain security technologies, including but no limited to SIEM/security monitoring tools, endpoint protection and EDR/XDR platforms, firewalls, configuration management systems, vulnerability management tools, identity and access management technologies, log collectors, and related integrations

Analyze security events and alerts, correlate activity across multiple tools and data sources, and provide initial assessments, trends, recommendations, and escalation information

Operate and support vulnerability scanning and assessment tools; schedule scans, review results, validate findings, and help identify affected systems and owners

Perform initial triage and investigation of security alerts and suspected incidents, gather relevant logs, sensitive information, and technical evidence, assess potentialsensitivity of impact, and escalate according to established procedures

Process account provisioning, access modification, suspension, and deprovisioning requests through approved workflows, ticketing systems, and identity management platforms

Identify opportunities to standardize, automate, and improve security operations, access management, vulnerability tracking, incident response workflows, and operational reporting

Essential Qualifications

Bachelor's Degree in a relevant field, preferably Computer Science, Information Security, Information Technology, Engineering, or an equivalent combination of education and experience

Minimum four years relevant work experience in information security, security operations, SOC analysis, threat analysis, vulnerability management, identity and access management

Significant exposure to information security practices, information risk assessments, security controls, operational security processes, or control assurance activities

Experience with one or more vulnerability management tools, such as Tenable, Qualys, or Rapid7

Experience with security monitoring, SIEM, SOAR, endpoint, firewall, or detection platforms, such as Microsoft Sentinel, Splunk, CrowdStrike, Microsoft Defender, SentinelOne, Palo Alto, Cisco, or similar technologies

Experience analyzing logs, alerts, endpoint telemetry, network events, authentication events, and system activity to support threat detection, incident triage, and remediation

Experience supporting incident response investigation, evidence gathering, sensitive or privileged information handling, containment, remediation, recovery, and post-incident improvement activities

Experience supporting identity lifecycle activities, access provisioning and deprovisioning, role-based access, group management, single sign-on, multi-factor authentication, access reviews, or privileged access controls

Exposure to network architecture, TCP/IP networking, VPN, VLAN, NAT, DNS, firewall, endpoint, operating system, cloud, and security concepts

Proficiency in at least one scripting or automation language, such as Python, PowerShell, shell scripting

Strong interpersonal skills and excellent oral and written communication skills

Excellent documentation, reporting, presentation, and knowledge-sharing skills

Strong technical troubleshooting, analytical, investigative, and problem-solving skills

Strong understanding of security operations, vulnerability management, identity and access management, incident response, and security monitoring concepts

Ability to interpret technical evidence, identify patterns, assess risk, and recommend practical remediation or escalation actions

Ability to describe complex technical concepts, security issues, and policy requirements to users, technical staff, managers, and senior stakeholders at varying levels of technical understanding

Ability to manage competing priorities, respond to urgent issues, and maintain accuracy and attention to detail in a fast-paced operational environment

Sound judgment, discretion, and professionalism when handling sensitive information, security incidents, access rights, logs, and investigation materials

Strong collaboration and customer-service orientation, with the ability to work effectively across IT, security, academic, research, administrative, vendor, and University stakeholder groups

Assets (Nonessential)

Relevant security, cloud, vendor, or identity-focused certifications: Security+, SSCP, GSEC, Microsoft Security Operations Analyst, Azure Security Engineer, vendor-specific firewall/EDR/SIEM certifications, or identity and access management credentials

Experience in a higher education, research, healthcare, or similarly complex environment

Familiarity with data visualization, dashboarding, reporting, or metrics tools

To be successful in this role you will be

Communicator

Diligent

Insightful

Perceptive

Procedural

Closing Date: 10/27/2026, 11:59PM ET

Employee Group: USW

Appointment Type : Budget - Continuing

Schedule: Full-Time

Pay Scale Group & Hiring Zone

USW Pay Band 12 -- $84,564 with an annual step progression to a maximum of $108,145. Pay scale and job class assignment is subject to determination pursuant to the Job Evaluation/Pay Equity Maintenance Protocol.

Job Category: Information Technology (IT)

Divisional HR Office Email: medhr@utoronto.ca

Lived Experience Statement

Candidates who are members of Indigenous, Black, racialized and 2SLGBTQ+ communities, persons with disabilities, and other equity deserving groups are encouraged to apply, and their lived experience shall be taken into consideration as applicable to the posted position.

Job descriptions are available upon request for internal applicants.