Security Technology Analyst

Date Posted: 10/06/2026
Req ID: 50456
Faculty/Division: Temerty Faculty of Medicine
Department: MedIT
Campus: St. George (Downtown Toronto)
Position Number: 00059989
Existing Vacancy: Yes

Description:

About us:

Home to over 40 departments and institutes, the University of Toronto's Temerty Faculty of Medicine lies at the heart of the Toronto Academic Health Science Network and is a global leader in ground-breaking research and education, spanning clinical medicine, basic science and the rehabilitation sciences sectors.

Your opportunity:

MedIT provides information technology support for the Temerty Faculty of Medicine. Our mission is to partner and collaborate with clients, University, and third parties to determine value based, sustainable technology solutions that enable the Faculty to achieve its academic mission.

As Security Technology Analyst, you will be responsible for implementing, tuning, and scaling advanced security technologies and AI tools to protect Temerty Faculty of Medicine systems, data, teaching, research, and administrative activities. Working closely with the Manager, Information Security, you will monitor multifaceted security data streams, proactively neutralizing threats through coordinated incident response, vulnerability management, and supporting incident response investigation. You will contribute to the secure and reliable operation of security technologies by working with vendor-specific platforms and tools such as firewalls, endpoint detection and response solutions, security information and event management systems, configuration and policy management systems, vulnerability management platforms, AI tools, and identity and access management technologies. You will prepare technical evidence and reporting, automate repeatable workflows, execute approved remediation activities, and collaborating cross-functionally with IT and University security teams to reduce risk and strengthen security operations.

Your responsibilities will include:

• Configure, tune, troubleshoot, and maintain security technologies, including but no limited to SIEM/security monitoring tools, endpoint protection and EDR/XDR platforms, firewalls, configuration management systems, vulnerability management tools, identity and access management technologies, log collectors, and related integrations
• Analyze security events and alerts, correlate activity across multiple tools and data sources, and provide initial assessments, trends, recommendations, and escalation information
• Operate and support vulnerability scanning and assessment tools; schedule scans, review results, validate findings, and help identify affected systems and owners
• Perform initial triage and investigation of security alerts and suspected incidents, gather relevant logs, sensitive information, and technical evidence, assess potentialsensitivity of impact, and escalate according to established procedures
• Process account provisioning, access modification, suspension, and deprovisioning requests through approved workflows, ticketing systems, and identity management platforms
• Identify opportunities to standardize, automate, and improve security operations, access management, vulnerability tracking, incident response workflows, and operational reporting

Essential Qualifications:

• Bachelor's Degree in a relevant field, preferably Computer Science, Information Security, Information Technology, Engineering, or an equivalent combination of education and experience
• Minimum four years relevant work experience in information security, security operations, SOC analysis, threat analysis, vulnerability management, identity and access management
• Significant exposure to information security practices, information risk assessments, security controls, operational security processes, or control assurance activities
• Experience with one or more vulnerability management tools, such as Tenable, Qualys, or Rapid7
• Experience with security monitoring, SIEM, SOAR, endpoint, firewall, or detection platforms, such as Microsoft Sentinel, Splunk, CrowdStrike, Microsoft Defender, SentinelOne, Palo Alto, Cisco, or similar technologies
• Experience analyzing logs, alerts, endpoint telemetry, network events, authentication events, and system activity to support threat detection, incident triage, and remediation
• Experience supporting incident response investigation, evidence gathering, sensitive or privileged information handling, containment, remediation, recovery, and post-incident improvement activities
• Experience supporting identity lifecycle activities, access provisioning and deprovisioning, role-based access, group management, single sign-on, multi-factor authentication, access reviews, or privileged access controls
• Exposure to network architecture, TCP/IP networking, VPN, VLAN, NAT, DNS, firewall, endpoint, operating system, cloud, and security concepts
• Proficiency in at least one scripting or automation language, such as Python, PowerShell, shell scripting
• Strong interpersonal skills and excellent oral and written communication skills
• Excellent documentation, reporting, presentation, and knowledge-sharing skills
• Strong technical troubleshooting, analytical, investigative, and problem-solving skills
• Strong understanding of security operations, vulnerability management, identity and access management, incident response, and security monitoring concepts
• Ability to interpret technical evidence, identify patterns, assess risk, and recommend practical remediation or escalation actions
• Ability to describe complex technical concepts, security issues, and policy requirements to users, technical staff, managers, and senior stakeholders at varying levels of technical understanding
• Ability to manage competing priorities, respond to urgent issues, and maintain accuracy and attention to detail in a fast-paced operational environment
• Sound judgment, discretion, and professionalism when handling sensitive information, security incidents, access rights, logs, and investigation materials
• Strong collaboration and customer-service orientation, with the ability to work effectively across IT, security, academic, research, administrative, vendor, and University stakeholder groups

Assets (Nonessential):

• Relevant security, cloud, vendor, or identity-focused certifications: Security+, SSCP, GSEC, Microsoft Security Operations Analyst, Azure Security Engineer, vendor-specific firewall/EDR/SIEM certifications, or identity and access management credentials
• Experience in a higher education, research, healthcare, or similarly complex environment
• Familiarity with data visualization, dashboarding, reporting, or metrics tools

To be successful in this role you will be:

• Communicator
• Diligent
• Insightful
• Perceptive
• Procedural

Closing Date: 10/27/2026, 11:59PM ET
Employee Group: USW
Appointment Type: Budget - Continuing
Schedule: Full-Time
Pay Scale Group & Hiring Zone:
USW Pay Band 12 -- $84,564 with an annual step progression to a maximum of $108,145. Pay scale and job class assignment is subject to determination pursuant to the Job Evaluation/Pay Equity Maintenance Protocol.
Job Category: Information Technology (IT)
Divisional HR Office Email: medhr@utoronto.ca

Lived Experience Statement
Candidates who are members of Indigenous, Black, racialized and 2SLGBTQ+ communities, persons with disabilities, and other equity deserving groups are encouraged to apply, and their lived experience shall be taken into consideration as applicable to the posted position.

Job descriptions are available upon request for internal applicants.