This is a fully remote position, open to applicants in Canada.

📋 Description

• Develop, fine-tune, document, and sustain detection logic across endpoint, cloud, container, and SaaS log sources.

• Support cyber forensic investigations involving diverse log sources.

• Enhance log ingestion pipelines and telemetry collection for actionable security insights while managing volume and cost efficiency.

• Design and construct SOAR playbooks and automation workflows for detection triage, enrichment, and response activities.

• Provide mentorship to junior security analysts and detection engineers on threat hunting, detection logic, and investigative methodologies.

• Seek out innovative attacker techniques and enhance detection coverage, quality, and scalability.

• Collaborate with teams across Engineering, Red Team, Incident Response, Fraud Prevention, and Trust & Safety.

⛳️ Requirements

• A minimum of 6 years of experience in detection engineering, incident response, or offensive security roles.

• Familiarity with one or more public cloud platforms such as AWS, Azure, or GCP.

• Comprehensive understanding of attacker TTPs within modern zero trust environments, including identity compromise, token theft, and violations of trust boundaries.

• Strong knowledge of macOS internals and telemetry for recognizing macOS-specific threats.

• Experience in implementing detection-as-code workflows, incorporating version control, peer review, automated testing, and CI/CD deployment pipelines.

• Basic proficiency in Python, Golang, or similar programming languages.

• Relevant certifications including GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or equivalent.

• Background in offensive security or red teaming.

• Understanding of machine learning applications for threat detection.