• Monitor and investigate alerts across SIEM, XDR, IDS/IPS, and email security tools. • Own incident response end-to-end: triage, containment, RCA, and reporting. • Improve and maintain IR playbooks and runbooks. • Run hypothesis-based threat hunts using TTPs, IOCs, and behavioral patterns. • Bring OSINT and threat intel insights into daily SOC workflows. • Monitor the dark web for leaked credentials and data exposure. • Build and tune high-quality detections using MITRE ATT&CK. • Enhance SIEM dashboards, correlation rules, and SOAR automations. • Reduce false positives and improve SOC efficiency. • Analyze network traffic, packet captures, and protocol behaviors. • Investigate phishing attempts and strengthen email security. • Onboard/validate log sources and ensure telemetry completeness. • Purple teaming to validate detections and test defenses.

About Certora Certora is the security assurance partner trusted by the most advanced teams in Web3. Founded in 2018 by pioneers in programming languages and formal methods, Certora helps leading protocols like Lido, Aave, Uniswap, and Compound secure billions in value with confidence. But we’re not just another auditor. We’re a full-stack security assurance platform, combining best-in-class formal verification tools with expert advisory services, delivered on time and with zero compromise. Whether you’re launching a new protocol, upgrading core infrastructure, or securing a DeFi primitive, Certora doesn’t just look for vulnerabilities. We help you prove correctness, accelerate your development speed, and embed safety into your design from day one. With Certora, you get: - Proven, scalable tooling for checking real deployed code - A deep partnership model with on-demand support - Fast, responsive execution that helps you go-to-market faster For us, security isn’t a checklist, it’s a continuous process. Certora is the most comprehensive and trusted platform to ensure your platform is protected, even under adversarial conditions. From testnet to mainnet, we’re with you. About the Role Certora is looking for an experienced SOC Analyst to join our Security Operations team. This role is centered around three core areas: SOC operations, incident response, and Web3 investigations. It is designed for a security professional who can take ownership of security events from initial triage through full investigation and response, while working effectively across internal teams and customer-facing situations. This role goes beyond alert monitoring and triage. It requires strong investigative capabilities, including event research, enrichment, root-cause analysis, and building a clear operational understanding of incidents across multiple environments. We are looking for someone with strong Web2 security fundamentals and deep understanding of Web3 security investigations, attack patterns, and response workflows. This is a non-shift position. However, availability outside business hours is required in the event of critical incidents. Key Responsibilities - Perform day-to-day SOC operations, including alert handling, triage, escalation, and response coordination - Lead end-to-end security incident investigations and response activities - Handle containment, eradication, recovery, and post-incident follow-up - Investigate and analyze security events across SIEM, EDR, cloud, and Web3-related data sources - Conduct deep event research and enrichment to establish context, assess impact, and support decision-making during incidents - Perform root-cause analysis and build a clear operational understanding of incidents across multiple systems and environments - Produce clear investigation reports, technical findings, and executive-level summaries - Work directly with customers during active security events in a professional and structured manner - Develop and maintain playbooks, runbooks, and operational procedures - Build and maintain automations using SOAR platforms, scripting, and API-based workflows - Develop, tune, and optimize detection rules and correlation logic - Improve SOC operational effectiveness and KPIs such as MTTD, MTTR, automation coverage, and detection quality - Contribute to cross-functional security initiatives and continuous improvement of team processes - Fluent English, with the ability to communicate clearly and professionally in both written and verbal form Mandatory Requirements - 3+ years of experience as a SOC Analyst, Incident Responder, or in a similar security operations role - Proven experience handling security incidents end-to-end - Strong hands-on experience in SOC operations, incident response, and security investigations - Strong knowledge of Web2 security fundamentals and deep understanding of Web3 security - Proven experience investigating Web3 attacks, including areas such as smart contracts, wallet abuse, transaction analysis, and on-chain activity investigation - Experience working directly with customers during security incidents or security operations engagements - Advanced hands-on experience with Splunk, including: - Writing and tuning detection rules - Parsing and data onboarding - Understanding Splunk architecture - Detection optimization and correlation logic - Experience working with EDR solutions such as SentinelOne, CrowdStrike, Microsoft Defender, or similar - Strong threat hunting and complex query-writing capabilities - Experience building automations and writing scripts using Python, Bash, and APIs - Ability to work independently, take ownership, and drive tasks through to completion - Strong written and verbal communication skills in English - Ability to work effectively in a remote environment while maintaining clear, proactive, and structured communication with the team lead and the rest of the team Nice to Have - Experience with Detection-as-Code methodologies - Experience with SOAR platforms - Cloud security experience in AWS / Azure / GCP - Experience working in a startup or high-growth environment - Strong incident response methodology knowledge, including root-cause analysis and lessons-learned processes Who You Are - Independent, accountable, and comfortable taking ownership end-to-end - Proactive, hands-on, and solution-oriented - A strong communicator and team player, with the ability to work remotely while maintaining clear and structured reporting - Fast learner, able to quickly ramp up on new technologies, domains, and attack patterns - Analytical and methodical, with strong investigative and root-cause analysis skills - Able to communicate technical findings clearly to both technical and non-technical stakeholders - Process-oriented, with a continuous improvement mindset - Automation-driven and focused on operational efficiency Certora People We are Customer Centric, when we commit, the customer knows we will deliver in a quality and timely manner. We Move Fast - we’re looking for people with a bias for action and a sense of urgency to achieve quick results while we also Break Nothing – we have high-quality standards, we are looking for people who are professional and hold themselves accountable. We win as a Team – our teams are distributed around the world. We understand our individual roles and commit to the team's goals. We have a positive “can do” attitude. We support each other and are encouraged to ask for help and advice. We enable people to grow by clarifying expectations and giving candid feedback and on-the-job development opportunities. We welcome collaboration both internally and externally for outstanding delivery. We are Pioneers in DeFi security. We are one of the best companies to help developers and security researchers secure Web3, but we try to stay humble and are always eager to learn more. Why join Certora? Certora provides you a wonderful opportunity to: - Work on cutting-edge technology and challenging problems at the forefront of Web3 applications and technologies - Contribute to securing the web3 ecosystem with the leading provider of end-to-end security for blockchain-based applications - Experience a friendly creative start-up environment with top talent in the domain - Work in a fast-paced and supportive culture: we move fast and break nothing! - Enjoy flexible work (remote / hybrid) - Get competitive compensation & benefits (including equity)

Title: Information Security Analyst Location: CA-Remote ID2026-34652 Category Information Technology Position Type Full-Time Remote Yes Job Description: About Kinaxis Are you looking to join an innovative, market-leading company where you can truly elevate your career? At Kinaxis we are serious about culture, we are serious about technology, we are serious about customers, and we are serious about not taking ourselves too seriously. If you are looking to be part of an incredible growth story, then we might just be the place for you! In 1984, we started out as a team of three engineers. Today, we have grown to become a global organization with over 2000 employees around the world, 6 global office and a best-in-class HQ in Ottawa, Canada. As winners of several Top Employer awards globally, we are proud to work with our customers and employees towards solving some of the biggest challenges facing supply chains today. Kinaxis is a global leader in modern supply chain orchestration, powering complex global supply chains, and supporting the people who manage them. Our powerful, AI infused platform provides full transparency and visibility across end-to-end supply chains, enabling our customers to make faster, better decisions. We are trusted by renowned global brands to provide the agility and predictability needed to navigate today’s volatility and disruption. With more than 40,000 users in over 100 countries, we are expanding our team as we continue to innovate and revolutionize how we support our customers. Location Ottawa, Canada - Hybrid Other Canadian Locations - Remote About the team The Information Security Analyst (Eastern Time Zone) is a cybersecurity professional responsible for supporting day‑to‑day security monitoring, incident triage, investigation support, and operational tasks across Corporate IT environments and the Kinaxis Maestro SaaS platform. In this role, you will be part of Kinaxis’s global follow-the-sun incident response framework, and serve as the first responder for the Eastern time zone, providing continuous monitoring and response by performing initial analysis of security alerts, escalating confirmed or suspected incidents, and assisting with investigations under led by senior analysts. This position is designed to build foundational security operations capabilities through hands‑on experience, structured processes, and close collaboration with experienced team members. You will work closely with team members across IT, SaaS Operations, Product Development, and Business Systems teams while developing technical depth, analytical judgment, and confidence in real-world security operations. What you will do Security Monitoring & Incident Response • Monitor security alerts and events from SIEM, XDR/EDR, and other security tools. • Perform initial triage and analysis of alerts to determine severity, scope, and required escalation. • Escalate confirmed or suspicious activity to senior analysts in accordance with documented procedures. • Assist with containment, investigation, and recovery activities under supervision. • Accurately document findings, actions taken, and handoffs in incident tracking systems. • Support active incident response efforts by gathering evidence, collecting logs, and performing basic analysis. • Participate in incident reviews and post‑incident learning activities. • Participate in shift handovers to ensure continuity of monitoring and response across time zones Threat Detection & Analysis Support • Assist in reviewing and validating detection alerts aligned to known attacker techniques. • Learn and apply basic threat concepts, indicators of compromise (IOCs), and MITRE ATT&CK mappings. • Support threat hunting activities by executing predefined queries and analysis tasks. • Help identify gaps or false positives in existing detections and report findings to senior team members Security Tooling and Operations • Use and maintain familiarity with core security tools such as SIEM, EDR/XDR, and cloud security platforms. • Assist in updating operational playbooks, runbooks, and knowledge articles. • Support testing of new detections, tools, or automation under guidance. • Partner with IT and engineering teams to validate logging, monitoring, and alerting coverage. • Stay informed about common cyber threats, vulnerabilities, and security best practices. • Participate in training, tabletop exercises, and continuous improvement initiatives. • Demonstrate curiosity, accountability, and willingness to learn in a fast‑paced operational environment. What we are looking for Primary Skills and Qualifications • Bachelor’s degree in Information Security, Computer Science, Information Technology, or a related field or equivalent hands‑on experience, internships, or co‑op placements. • 3–5 years of experience in cybersecurity, IT operations, SOC, or related technical roles. • Basic understanding of cybersecurity concepts such as malware, phishing, authentication, and network security. • Strong analytical and problem‑solving skills, with attention to detail. • Clear written and verbal communication skills. • Ability to follow procedures, accept feedback, and work effectively as part of a global team. • Comfortable working in a shift‑based or follow‑the‑sun operational model • Certifications: Desired o CompTIA Security+ , CompTIA CySA+ o Microsoft Security Fundamentals o Cloud fundamentals (Azure, AWS, or GCP) Preferred o CISSP, CCSP, GIAC (GCIH, GCIA, GCED, GCFA) or equivalent Role Specific Skills and Experience • Exposure to SIEM or security monitoring tools (e.g., Microsoft Sentinel, Splunk, or similar). • Basic understanding of incident response processes and alert triage. • Familiarity with common attack techniques and indicators. • Experience following established playbooks and runbooks during security events. • Introductory knowledge of cloud platforms and SaaS environments. • Awareness of security technologies such as firewalls, EDR, IAM, and logging systems. • Knowledge of industry frameworks such as NIST CSF, ISO 27001, or SOC 2. • Knowledge of attacker TTPs, threat modeling, IOCs/IOAs, and MITRE ATT&CK. • Understanding of security technologies including firewalls, IDS/IPS, IAM, encryption, and authentication mechanisms. #Intermediate, #LI-EM1 Work With Impact: Our platform directly helps companies power the world’s supply chains. We see the results of what we do out in the world every day, when we see store shelves stocked, when medications are available for our loved ones, and so much more. Work with Fortune 500 Brands: Companies across industries trust us to help them take control of their integrated business planning and digital supply chain. Some of our customers include Lockheed Martin, Unilever, P&G, ExxonMobil, Cisco and more. Social Responsibility at Kinaxis: Our Diversity, Equity, and Inclusion Committee weighs in on hiring practices, talent assessment training materials, and mandatory training on unconscious bias and inclusion fundamentals. Sustainability is key to what we do and we’re committed to a long-term net-zero operations strategy. We are involved in our communities and support causes where we can make the most impact. People matter at Kinaxis and here are some of the perks and benefits we offer, which may vary by location and employee: - Flexible vacation and Kinaxis Days (company-wide days off) - Flexible work options - Physical and mental well-being programs - Regularly scheduled virtual fitness classes - Mentorship programs, training, and career development - Recognition programs and referral rewards - Hackathons

The Opportunity: We are seeking an experienced and highly motivated Information Security Analyst to join our security team. This role will be critical in protecting our digital assets, detecting and responding to security incidents, and ensuring the continuous improvement of our security posture. You will work proactively to identify security risks, develop, and implement security frameworks, and ensure the integrity and confidentiality of our IT systems and data. The successful candidate will be responsible for all KPIs related to cyber security. You will be expected to coordinate implementation of all information security related processes in conjunction with others at Rainforest Alliance. You will also be handling and coordinating task/activities by firms/individuals contracted to provide information security services, working to ensure peers, senior and junior colleagues deliver necessary environment improvements effectively and expediently. The ideal candidate will have a strong technical background and confirmed hands-on experience in securing Microsoft cloud environments (Azure, Entra ID, Microsoft 365, Purview, Defender Suite), implementing endpoint hardening strategies, and using advanced security tools. Key Responsibilities: Security Operations & Incident Response: - Participate in security incident response activities, including investigation, containment, eradication, recovery, and post-incident analysis. - Monitor security alerts from various sources (SIEM, EDR, cloud logs) and respond to security incidents in a timely manner. - Develop and maintain security documentation, including procedures, runbooks, and incident response plans. - Conduct vulnerability assessments and assist in penetration testing remediation efforts. Security Awareness & Training: - Contribute to the development and delivery of security awareness training for employees, acting as a domain authority for security best practices. Collaboration: - Work closely with all IT teams, Enterprise Architecture, PMO and other stakeholders to ensure security is integrated into all aspects of our infrastructure and applications at the design and requirements stage. - Through reporting, monitoring and alerting, find opportunities for automation and improvement of RA security posture, including exception handling of threat alerts, patches, system and software vulnerabilities. Reporting: - Creation of weekly and monthly reporting packs, demonstrating rolling position on vulnerabilities, threats, progress against plan on key security initiatives. Risk Management: - Conduct risk assessments and participate in security design reviews to ensure appropriate mitigations are in place for new services and system changes (shifting security left). Azure Security: - Administer and configure Azure security services (e.g., Azure Security Centre/Defender for Cloud, Defender for Endpoint, Azure Network Security Groups, Azure Key Vault, Azure Firewall etc). - Monitor Azure environments for security threats, vulnerabilities, and misconfigurations. - Implement and make sure security best practices within Azure IaaS and PaaS deployments, audit Azure resources for compliance. Entra ID (Azure AD) Security: - Lead and secure Entra ID (Azure Active Directory) including Conditional Access Policies, Multi-Factor Authentication (MFA), Identity Governance, and Privileged Identity Management (PIM). - Monitor Entra ID for suspicious activity and unauthorised access attempts. - Implement Zero Trust principles, ensuring least privilege access, secure authentication flows, and continuous risk-based conditional access. Microsoft 365 Administration & Security: - Secure Microsoft 365 services (Exchange Online, SharePoint Online, OneDrive, Teams, etc.), looking after user access, data governance, and threat protection within the Microsoft 365 ecosystem. - Configure and optimise Microsoft 365 security features (e.g., Defender for Office 365, Data Loss Prevention (DLP), Microsoft Purview + compliance policies). Endpoint Hardening: - Develop, implement, and maintain security baselines and hardening standards for endpoints (Windows, macOS, Linux). - Configure and handle Microsoft Entra Domain Services based Group Policies (GPOs) and equivalent Mobile Device Management (MDM) solutions for security settings. - Ensure secure configuration and patch management across all endpoints. - Report on exceptions to relevant Team Managers and ensure mitigation is undertaken, through regular engagement. XDR: - Administer, configure, and optimise RA’s XDR service, currently Crowdstrike Falcon but planned for migration to Microsoft Defender XDR. - Monitor alerts and dashboards for endpoint security incidents and threats, perform threat hunting and incident response activities using CrowdStrike data. - Develop and refine custom detections and response playbooks within CrowdStrike. Vulnerability Scanning: - Identify and prioritise remediation of CVE-aligned vulnerabilities - Provide reporting to IT leadership on progress against remediation targets - Notify IT teams of emerging high/critical vulnerabilities and coordinate remediation planning - Devise reporting dashboards for senior IT leadership Required Qualifications: - Minimum of 3 years of hands-on experience in an information security role. - Proven working experience and deep understanding of Azure security services and best practices. - Extensive hands-on experience with Entra ID (Azure Active Directory) and Microsoft 365 security administration. - Demonstrable experience with endpoint hardening methodologies and implementation. - Hands-on administration and operational experience with CrowdStrike Falcon platform. - Experience with security incident response and threat hunting. - Solid understanding of networking concepts. - Familiarity with security frameworks (e.g., Cyber Essentials, NIST, ISO 27001). - Excellent analytical, problem-solving, and communication skills. - Ability to work independently and as part of a team in a fast-paced environment. Preferred Qualifications: - Relevant security certifications (e.g., AZ-500 Microsoft Certified: Azure Security Engineer Associate, SC-200 Microsoft Certified: Security Operations Analyst Associate, CompTIA Security+, CISSP, GIAC certifications). - Experience with scripting languages (e.g., PowerShell, Python) for automation and security tasks. - Knowledge of cloud security posture management (CSPM) tools. - Demonstrable experience with other EDR/XDR solutions. - Understanding of regulatory and technical compliance requirements (e.g., GDPR, HIPAA, PCI DSS, CIS, NIST, ISO27001). Deadline: 01 May 2026 Salary: Commensurate with experience Notes: Only candidates legally authorized to work in either Costa Rica, Colombia, Peru, Guatemala, Mexico or Brazil will be considered. If you have any questions about the job vacancy, please contact the HR department: recruitment@ra.org The Rainforest Alliance encourages diversity and inclusion across the global organization. With this commitment to diversity, we are proud to be an equal opportunity employer and do not discriminate on the basis of gender, race, color, ethnicity, religion, sexual orientation, gender identity, ages, disability and any other protected group.