SOC Analyst Prin

Dayforce is a global human capital management (HCM) company headquartered in Toronto, Ontario, and Minneapolis, Minnesota, with operations across North America, Europe, Middle East, Africa (EMEA), and the Asia Pacific Japan (APJ) region. 

Our award-winning Cloud HCM platform offers a unified solution database and continuous calculation engine, driving efficiency, productivity and compliance for the global workforce.

Our brand promise - Makes Work Life Better™- Reflects our commitment to employees, customers, partners and communities globally.

About the Role:

The Principal SOC Analyst is a senior hands-on technical and operational role within Dayforce Cybersecurity Operations, responsible for advancing the effectiveness, maturity, and scalability of Security Operations. The role provides leadership in operational excellence (BAU), incident handling quality, process alignment, analyst enablement, and continuous improvement across a globally distributed environment.

The successful candidate serves as the principal technical and operational partner to Cybersecurity Security Operations leadership, translating strategic objectives into operational outcomes while driving process maturity, service quality, automation adoption, AI innovation, executive reporting, and continuous improvement across Cybersecurity Operations.

Critical Results

The Principal SOC Analyst will be expected to deliver the following outcomes:

1. Cybersecurity Security Operations BAU Leadership and Operational Execution (35%) – Support SOC leaders in the day-to-day technical management of SOC BAU operations by maintaining operational rhythm, monitoring service quality, coordinating priorities, improving handovers and escalations, and ensuring analysts have the clarity, guidance, and process discipline needed to deliver consistent outcomes
2. Incident Handling Oversight and Quality Improvement (20%) – Improve the quality, consistency, and timeliness of security incident handling by strengthening triage practices, escalation paths, evidence quality, case documentation, containment coordination, post-incident follow-up, and lessons-learned activities without becoming the primary owner of all day-to-day case work
3. Process Maturity and Continuous Improvement (20%) – Identify, analyse, and resolve recurring SOC operational issues by improving processes, playbooks, runbooks, quality controls, operating procedures, metrics, and governance practices that increase reliability, reduce friction, and mature the way the SOC operates
4. Automation, AI, and Operational Enablement (10%) – Drive practical improvement opportunities by leveraging automation, AI-assisted workflows, analytics, dashboards, and tool optimisation to reduce manual effort, improve decision quality, enhance analyst productivity, and create scalable operational practices across Cybersecurity Security Operations workflows
5. Stakeholder and Communication (10%) – Translate operational and technical matters into clear, concise communication for leaders, partners, engineering/application/support teams, incident management, and business stakeholders, including status updates, risk summaries, operational metrics, improvement plans, and decision-support materials
6. Analyst Enablement and Knowledge Management (5%) – Promote operational excellence through technical coaching, documentation, knowledge sharing, process improvement, and quality assurance activities that enhance analyst effectiveness and consistency, while partnering with people leaders on development initiatives as needed

Qualifications

The ideal candidate will have demonstrable:

1. Deep hands-on experience in Security Operations. With a proven track record of operating as a senior analyst, technical lead, shift lead, SOC engineer, or deputy to SOC leadership in a complex security operations environment
2. Strong understanding of SOC BAU, incident handling, and operational execution. Including alert triage, incident escalation, case quality, handovers, response coordination, post-incident follow-up, service quality, and the practical realities of running a high-performing SOC
3. Proven ability to improve processes and operational maturity. Including the ability to identify recurring pain points, perform root cause analysis, define sustainable improvements, strengthen runbooks and playbooks, and drive measurable improvements in reliability, efficiency, and quality
4. Broad technical knowledge of modern security operations technologies. Including SIEM, EDR, SOAR, network security, cloud security, identity security, threat intelligence, ticketing, ITSM, incident management, vulnerability management, and reporting platforms, with the ability to connect tools, workflows, and outcomes
5. Practical capability to leverage automation, AI, and data-driven improvement. Including the ability to identify high-value automation opportunities, use analytics and metrics to support decisions, partner with engineering teams on workflow improvements, and apply AI-assisted approaches responsibly to improve operational effectiveness
6. Strong stakeholder management and communication skills. With the ability to translate complex technical and operational topics into clear business language, prepare leadership-ready updates, influence stakeholders, and communicate effectively with technical and non-technical audiences
7. Advanced technical, analytical, and leadership capabilities. Including sound judgement, calm decision-making under pressure, mentoring and coaching ability, strong documentation practices, familiarity with Agile or continuous improvement methods, and relevant industry certifications such as CEH, GASAE, CISSP, GCIH, Security+, CySA+, cloud security certifications, or equivalent experience.

Working Conditions 

1. This role is primarily remote based in APJ, offering flexibility and balance, with occasional in-office attendance or travel for team collaboration, planning sessions, or business needs
2. The role supports a globally distributed cybersecurity organisation and requires effective collaboration across multiple regions and time zones
3. This is a hands-on technical and operational position involving regular interaction with SOC processes, security tools, incident workflows, reporting, automation platforms, cloud infrastructure, and operational stakeholders
4. The role may be called upon to support critical security incidents, major operational events, escalations, automation issues, or other high-priority technical matters
5. Flexibility in working hours is occasionally required to support deployments, stakeholder engagements, incident response activities, leadership updates, and operational priorities
6. Participation in on-call rotations or escalation support may be required based on business and operational needs
7. The successful candidate will thrive in a dynamic, fast-paced environment where priorities may shift in response to emerging threats, incident severity, operational demands, or strategic initiatives
8. The role requires a high degree of ownership, accountability, sound judgement, and the ability to work independently while partnering effectively with global Cybersecurity team.

What’s in it for you

Dayforce is fueled by the diversity of our talented employees. We are an equal opportunity employer and consider and embrace ALL individuals and what makes them unique. We believe our employees should be happy and healthy, with peace of mind and a sense of fulfillment.

We encourage individuals to apply based on their passions.

Dayforce encourages personal and professional growth. We offer excellent time away from work programs, comprehensive wellness initiatives and recognition through competitive pay and benefits.

With a commitment to community impact, including volunteer days and our charity, Dayforce Cares we provide opportunities for you to thrive both in your career and personal life. Our focus is not just on your job but on supporting you to be the best version of yourself. 

Artificial intelligence may be used in the screening, assessment, or selection of applicants for this position.

Fraudulent Recruiting

Beware of fraudulent recruiting. Legitimate Dayforce contacts will use an @dayforce.com email address. We do not request money, checks, equipment orders, or sensitive personal data during the recruitment process. If you have been asked for any of the above, or believe you have been contacted by someone posing as a Dayforce employee, please refer to our fraudulent recruiting statement found here: https://www.dayforce.com/be-aware-of-recruiting-fraud

Dayforce actively monitors all job applications to ensure authenticity. Submissions determined to be fraudulent or misleading will be declined from the recruitment process