Staff Specialist, Security Operations

This is a fully remote position, open to applicants in Canada.

📋 Description

• Develop the complete security operations pipeline, encompassing alert integrations, triage, enrichment, correlation, investigation documentation, and routing outcomes to Jira.

• Establish the agent trust framework, which includes evaluations, safeguards against prompt injection, and prevention of permission abuse.

• Remove false positives and inadequately assessed findings from security tools.

• Spearhead detection-as-code engineering in alignment with MITRE ATT&CK.

• Manage incident response from initial triage to postmortem analysis.

• Supervise the performance of the managed detection partner against defined measurable criteria.

• Integrate security findings into development team workflows, providing evidence and a clear remediation path.

• Create detection and response agents and validate their reliability.

• Collaborate with the Director of Infrastructure and Security, the Staff Application Security Specialist, the Security Tooling team, Infrastructure, ITX, and Product Engineering.

⛳️ Requirements

• Proficiency in English is mandatory.

• A minimum of 7 years of experience in security operations, incident response, or detection engineering.

• Recent hands-on experience in a cloud-based SaaS environment is required.

• Strong background in validating findings, eliminating false positives, and making decisions based on incomplete information.

• Experience collaborating directly with development teams to implement fixes without formal authority.

• Proficient in building and deploying security agent systems, including MCP servers, Claude Skills, or custom tools.

• Familiarity with evaluations that assess the reliability of agent outputs.

• Understanding of failures and attacks impacting agentic systems, such as prompt injection and permission/credential management.

• Expertise in detection-as-code engineering and a SIEM query language.

• Strong comprehension of identity- and cloud-based attack pathways, particularly in Azure and Entra ID.

• Experience in leading a managed detection partner, threat hunting, or forensics is a plus.

• Proficiency in French is an advantage.

🏝️ Benefits

• Annual bonus program.

• Long-term incentive plan (LTIP), providing participation in Workleap’s long-term growth.

• RRSP contributions.

• Family group insurance coverage.

• Telemedicine services.

• Annual wellness budget.

• Flexible vacation policy.

• Remote work options, with access to the Montreal offices.

• In-person gatherings twice a year.

• Claude available to all employees.