Staff Security Operations Specialist

This is a fully remote position, open to applicants in Canada.

📋 Description

• Take charge of how Workleap identifies, investigates, and responds to threats across both Workleap and ShareGate.

• Develop the comprehensive security operations pipeline, which includes alert integrations, agentic triage, enrichment, correlation, and the drafting of investigations.

• Link investigation outcomes to Jira, providing evidence and remediation strategies.

• Establish the trust model for security agents, encompassing autonomous closures, recommendations, and human escalation.

• Create evaluations and secure agents against prompt injection and permission abuse.

• Minimize false positives and enhance the prioritization of findings.

• Oversee detection engineering as code aligned with MITRE ATT&CK.

• Lead the security incident response process from triage to postmortem analysis.

• Manage performance expectations for the managed detection partner.

• Provide actionable security insights to developers within their workflow.

• Report directly to the Director of Infrastructure and Security while collaborating with application security, security tooling, infrastructure, ITX, and product engineering teams.

⛳️ Requirements

• A minimum of 7 years of experience in security operations, incident response, or detection engineering, with recent hands-on experience in a cloud SaaS environment.

• Extensive experience in validating tooling findings, tuning false positives, and making informed decisions with partial evidence.

• Proven history of working directly with developers to implement fixes without having formal authority.

• Experience in building and deploying agent systems for security tasks, such as MCP servers, Claude skills, subagents, or custom tools, with evaluations that establish when output is reliable.

• Knowledge of agentic-system failures and attacks, including prompt injection, tool permission scoping, and credential management.

• Proficiency in detection engineering, including detection as code, fluency in SIEM query languages, and tracking false-positive rates.

• Strong understanding of identity and cloud attack vectors, particularly in Azure and Entra ID.

• Bonus: Experience managing a detection partner, conducting threat hunting or forensics, and proficiency in French.

🏝️ Benefits

• Annual bonus program.

• Long-Term Incentive Plan (LTIP), allowing you to share in Workleap's long-term growth.

• Registered Retirement Savings Plan (RRSP).

• Family health insurance coverage.

• Telemedicine services.

• Annual wellness budget.

• Flexible vacation policy.

• Opportunity for remote work, with access to our Montreal office.

• In-person gatherings held twice a year.

• Access to Claude for all employees.