Staff Security Engineer, AI-Driven Detection – Response

This is a fully remote position, open to applicants in Canada.

📋 Description

• Define and lead Fullscript's defensive threat detection, incident response, and AI-driven SecOps capabilities across cloud infrastructure, identity, endpoints, and application ecosystems.

• Establish multi-quarter technical direction for detection and response across Security, Platform, and Engineering teams.

• Design, develop, maintain, test, optimize, and decommission detection logic across SIEM, cloud infrastructure, identity systems, endpoint protection, and AI/ML pipelines.

• Create detection coverage and defensive controls against AI and agentic threat vectors, such as prompt injection, tool misuse, and data exfiltration.

• Assess detection coverage, precision, false-positive rates, and time-to-detect.

• Develop dashboards and reports for alert volume, response times, and trends.

• Design and implement AI-assisted investigation workflows utilizing LLMs and automated agents.

• Build and enhance internal security tools for identity resolution, cross-source log correlation, and natural-language security telemetry queries.

• Automate transitions between detection tools and ticketing systems.

• Lead and support security investigations from initial triage to containment and resolution.

• Mentor members of the Security Operations team and set standards for rule quality, detection-as-code, and investigation rigor.

• Collaborate with business teams to investigate and address security escalations.

• Maintain and refine incident response playbooks.

• Participate in an on-call rotation outside of business hours.

• Conduct threat modeling for systems, AI agents, and services.

• Lead defensive testing, purple-teaming, and adversarial validation exercises.

• Ensure AI services and features provide necessary logging and telemetry.

• Evaluate changes in authorization and access control and drive necessary remediation efforts.

• Operationalize threat intelligence into actionable detections and tracked follow-up tasks.

• Coordinate IOC blocking across endpoint, network, and web layers.

⛳️ Requirements

• 8+ years of experience in detection engineering, incident response, or security engineering, with proven leadership in shaping organizational security strategy.

• Practical experience integrating AI tools into SecOps workflows and familiarity with detection strategies targeting AI-specific threat vectors.

• Strong scripting and automation skills in Python, JavaScript, or similar languages.

• Experience creating workflows in a SOAR-style or workflow automation platform.

• Experience managing security controls as code, such as Terraform, through peer review rather than manual console changes.

• Experience securing cloud environments, preferably AWS, along with modern SaaS and identity stacks.

• Hands-on incident response experience, including triage, investigation, containment, and postmortem/playbook development.

• Working knowledge of adversary tradecraft, including MITRE ATT&CK, and the ability to translate it into practical, tuned detections.

• Ability to collaborate directly with engineering and infrastructure teams to define telemetry and control requirements.

• Excellent written communication skills.

• Experience contributing to or creating from open detection content, such as Sigma rules or community rule repositories (bonus).

• Experience collaborating on red/purple-team exercises to validate detection coverage (bonus).

• Experience working in a healthcare, regulated, or highly sensitive-data environment (bonus).

• Relevant certifications such as GCIH, GCFA, GCTI, or GCDA, or equivalent practical experience (bonus).

🏝️ Benefits

• Generous PTO and competitive salary.

• Fullscript’s RRSP match program to support financial well-being.

• Flexible benefits package and workplace wellness initiatives.

• Training budget and company-wide learning programs.

• Discount on Fullscript's catalog of products.

• Option to work in-office, remotely, or a hybrid arrangement under the Wherever You Work Well philosophy.