Senior Security Engineer, Detection and Response

Team: IT

Location: Canada

Commitment: Full-time

Workplace Type: remote

Accountabilities

• Act as the lead security responder for North American time zones, triaging and investigating complex alerts and supporting the Cybersecurity Incident Response Team.

• Participate in a 24x7x365 on-call rotation, providing senior-level expertise and escalation support during security events and incidents.

• Engineer, maintain, and continuously optimize detection logic across multiple security data sources using threat modeling and current threat intelligence.

• Design and maintain detection coverage maps to identify capabilities, visibility gaps, and areas requiring additional monitoring.

• Develop and track security KPIs with leadership, including detection effectiveness, false-positive rates, and mean time to detect, respond, and recover.

• Create and maintain incident response runbooks, standard operating procedures, and technical documentation to promote consistent response practices.

• Build automation workflows and orchestration playbooks that improve detection engineering, threat hunting, and incident response efficiency.

• Develop and leverage AI-driven tools to accelerate security investigations and strengthen Security Operations and Incident Response capabilities.

• Conduct proactive, hypothesis-driven threat hunts across corporate and production environments.

• Support the logging and monitoring infrastructure required for effective threat detection and investigation.

• Mentor junior team members in security operations, detection engineering, and incident response methodologies.

Requirements:

• 5+ years of hands-on experience in security operations, with a strong focus on incident response and detection engineering.

• Additional experience in threat hunting, cyber threat intelligence, and digital forensics is highly valued.

• Strong investigative instincts and intellectual curiosity, with the ability to analyze anomalies, follow evidence trails, and reconstruct complex security incidents from fragmented data.

• Solid technical expertise across enterprise security technologies, including EDR, NDR, CSPM, EASM, SIEM, SOAR, and cloud security platforms such as AWS GuardDuty.

• Strong knowledge of threat intelligence frameworks, particularly MITRE ATT&CK, and experience applying them to assess detection capabilities and coverage gaps.

• Demonstrated ability to develop threat detection use cases based on telemetry analysis, environment baselining, actionable threat intelligence, and incident response findings.

• Experience identifying detection and visibility gaps across infrastructure and collaborating with stakeholders to improve logging and detection content.

• Strong understanding of AWS cloud services and containerization technologies.

• Industry certifications in incident response or related disciplines, such as GCIH, GCFA, GIME, OSIR, or GEIR, are strongly preferred.

• Programming experience with Python, JavaScript, or Go is an asset.

• Familiarity with infrastructure-as-code tools such as Terraform is an asset.

• Experience with forensic tools such as KAPE, EnCase, FTK, or Volatility is a plus.

• Experience with Detection-as-Code technologies such as Sigma or YARA is a plus.

• Experience conducting Purple Team exercises, validating vulnerabilities or reported bugs, and working with observability or SRE tools and processes is beneficial.

Benefits:

• Competitive base salary of CAD 136,800–171,000, depending on location, skills, and experience.

• Annual bonus opportunities based on individual and organizational performance.

• Multiple health insurance options.

• Flexible vacation time plus additional floating holidays.

• Retirement savings program with company contributions.

• Equity in a publicly traded company.

• Monthly stipend to support remote work.

• Annual professional development stipend.

• Family-forming benefits.

• Generous parental leave with base salary top-up.

• Fully remote work within Ontario or British Columbia, Canada.