Staff Security Operations Specialist

This is a fully remote position, open to applicants in Canada.

📋 Description

• Take ownership of how Workleap and ShareGate identify, investigate, and respond to security threats.

• Develop a comprehensive security operations pipeline, incorporating source-tool integrations, agent-based triage, enrichment, correlation, and drafting investigations.

• Link security findings to Jira, providing both evidence and a path for remediation.

• Establish the trust model for security agents and ascertain which actions necessitate human judgment.

• Implement evaluations to safeguard agents against prompt injection and permission abuse.

• Minimize false positives while accurately prioritizing security findings.

• Manage detection engineering as code in alignment with the MITRE ATT&CK framework.

• Lead the security incident response process from triage through to postmortem analysis.

• Hold the managed detection partner to defined measurable standards.

• Provide developers with security findings that include clear evidence and remediation paths.

• Report directly to the Director of Infrastructure and Security, collaborating with application security, security tooling, infrastructure, ITX, and product engineering teams.

• Contribute to LeapSec's security operations strategy, including integrating security within product squads and automating the collection of SOC 2 evidence.

⛳️ Requirements

• Over 7 years of experience in security operations, incident response, or detection engineering, with recent practical experience in a cloud SaaS environment.

• Extensive expertise in validating tool findings, tuning false positives, and making decisions based on incomplete evidence.

• Proven history of collaborating directly with developers to implement fixes without requiring authority.

• Experience in building and deploying agent systems for security tasks, such as MCP servers, Claude skills, subagents, or custom tools, with evaluations to determine trusted output.

• Familiarity with agentic-system failures and attacks, including prompt injection, permission scoping for tools, and credential management.

• Background in detection engineering, including detecting threats as code, proficient use of SIEM query languages, and assessing false-positive rates.

• Strong understanding of identity and cloud attack paths, particularly in Azure and Entra ID.

• Bonus: experience leading a managed detection partner, threat hunting, or forensics, and proficiency in French.

🏝️ Benefits

• Annual bonus program.

• Long-Term Incentive Plan (LTIP), allowing participation in Workleap's long-term growth.

• RRSP.

• Family health insurance.

• Telemedicine services.

• Annual wellness budget.

• Flexible vacation policy.

• Remote work opportunities, with access to the Montreal office.

• In-person gatherings held twice a year.

• Access to Claude for all employees.