Senior Security Engineer, Detection and Response

This is a fully remote position, open to applicants in Canada.

📋 Description

• Lead incident response activities for North America.

• Act as the primary security responder within the North American time zones.

• Triage and conduct investigations on intricate alerts.

• Serve as a key member of the Cybersecurity Incident Response Team.

• Engage in 24x7x365 on-call rotations and provide senior-level escalation support.

• Engineer, maintain, and enhance detection logic across various data sources.

• Utilize threat modeling to ensure detection coverage is up-to-date.

• Design mapping for detection coverage and pinpoint blind spots in the threat landscape.

• Develop and monitor detection and response KPIs in collaboration with leadership.

• Create and uphold incident response runbooks, SOPs, and technical documentation.

• Mentor junior team members in the areas of security operations, detection engineering, and incident response.

• Construct automation workflows and orchestration playbooks.

• Develop and utilize AI-driven tools for Security Operations and Incident Response.

• Conduct proactive, hypothesis-driven threat hunts across corporate and production environments.

• Support the infrastructure for logging and monitoring.

⛳️ Requirements

• Over 5 years of hands-on experience in security operations, focusing on Incident Response and Detection Engineering.

• Additional expertise in threat hunting, cyber threat intelligence, and digital forensics is preferred.

• Industry certifications in Incident Response or related fields are strongly preferred, such as GCIH, GCFA, GIME, OSIR, or GEIR.

• Hands-on experience with enterprise security tools including EDR, NDR, CSPM, EASM, SIEM, SOAR, and cloud security platforms like GuardDuty.

• Proficient in MITRE ATT&CK and its application for assessing detection capabilities and coverage gaps.

• Expertise in developing threat detection use cases based on security telemetry analysis, environment baselining, actionable threat intelligence, and findings from incident response.

• Ability to identify detection coverage gaps across global infrastructures and collaborate with stakeholders to enhance logging and detection content.

• Strong understanding of AWS cloud services and containerization technologies.

• Experience with programming languages such as Python, JavaScript, or Go is preferred.

• Familiarity with Terraform is preferred.

• Experience with tools like KAPE, EnCase, FTK, or Volatility is preferred.

• Experience with Sigma or YARA is preferred.

• Experience conducting Purple Team exercises and writing reports is preferred.

• Experience in validating vulnerabilities or reported bugs is preferred.

• Experience with Observability or SRE tools and processes is preferred.

• Participation in a 24x7 on-call rotation is necessary.

• Ability to work within North American time zones.

🏝️ Benefits

• Annual bonuses for eligible employees.

• Multiple health insurance options available.

• Flexible vacation time along with additional floating holidays.

• Retirement savings program with company contributions.

• Equity in a publicly traded company.

• Monthly stipend to support remote work arrangements.

• Annual development stipend.

• Family-forming benefits.

• Generous parental leave with base salary top-up.

• Flexible First work model.