Threat Operations & Detection Specialist

Dentons is designed to be different. Our Firm leads the way in a rapidly changing legal marketplace. We challenge the status quo and deliver consistent results as well as uncompromising quality and value to our clients. Our global presence is renowned as a firm with over 21,000 individuals in more than 200 offices serving clients across 80+ countries. Dentons Canada is committed to its people and communities. We are consistently recognized as an employer of choice having received numerous awards including being selected as one of Canada’s Top 100 Employers (2026); Canada’s Top Employers for Young People (2026), and Canada’s Best Diversity Employers (2026). This role is an opportunity for you to join Canada's Global Law Firm, a firm that offers opportunities to build your career while growing your skills and deepening your expertise. ROLE Dentons Canada LLP is currently recruiting for a Threat Operations & Detection Specialist who will be responsible for continuously improving threat detection, response readiness, and cyber resilience across the Canada technology environment. This role is not a traditional SOC (Security Operations Center) position. The candidate will govern the Managed Detection and Response (MDR) service, lead detection engineering, support incident response, perform threat hunting, and act as a technical escalation and backup for operational security requests when required. KEY RESPONSIBILITIES & ACCOUNTABILITIES MDR Governance & Detection Engineering

• Govern the MDR service to ensure high-quality monitoring, escalation, investigation support, reporting, and continuous improvement.
• Develop, tune, and maintain high-fidelity detection use cases across Microsoft Sentinel, Defender XDR, identity, endpoint, cloud, email, and network telemetry.
• Improve detection coverage using MITRE ATT&CK, threat intelligence, incident learnings, audit findings, and identified control gaps.
• Work with the MDR provider to reduce false positives, validate alerts, improve escalation quality, and ensure meaningful visibility into priority threats.
• Support log source onboarding, detection coverage assessments, analytics development, dashboarding, and operational reporting.
• Develop and maintain detection logic, response playbooks, and automation workflows that improve mean time to detect and contain security events.

Threat Hunting, Incident Response & Technical Investigation

• Conduct proactive threat hunting using SIEM, EDR/XDR, identity, cloud, email, network, and other relevant telemetry sources.
• Triage, investigate, and respond to escalated security alerts, incidents, and suspected compromise activity in partnership with the MDR provider and internal teams.
• Act as a technical responder for phishing, malware, account compromise, endpoint compromise, insider threat, suspicious access, and cloud security events.
• Support containment, eradication, recovery, forensic evidence collection, incident timelines, and post-incident reviews.
• Translate incident findings into improved detections, response procedures, preventive controls, and security awareness actions.
• Participate in incident tabletop exercises, purple team exercises, and response readiness activities.

Threat Intelligence, Emerging Threats & Continuous Improvement

• Monitor emerging threats relevant to professional services and legal environments, including identity compromise, ransomware, supply chain attacks, cloud abuse, API abuse, data theft, and AI-enabled phishing.
• Convert threat intelligence into practical detection use cases, hunting hypotheses, playbook improvements, and preventive recommendations.
• Produce operational threat reports, detection coverage summaries, incident trends, and metrics for Security leadership and stakeholders.
• Collaborate with the Information Security Design Specialist and Cloud & Vulnerability Specialist to ensure threat intelligence informs architecture, configuration, and exposure reduction priorities.
• Identify opportunities for SOAR, automation, AI-assisted investigation, and process improvement across detection and response workflows.

Security Services Backup & Operational Escalation

• Support escalated phishing investigations, security mailbox inquiries, high-risk URL or web filtering requests, DLP alerts, exception reviews, and operational security tickets when required.
• Provide coaching, quality review, and technical guidance to the Security Services function for phishing triage, evidence gathering, ticket enrichment, escalation paths, and operational procedures.
• Ensure operational work is documented, repeatable, and improved through runbooks, knowledge articles, automation, and clear escalation criteria.

SKILLS & COMPETENCIES

• Strong hands-on experience in cybersecurity operations, incident response, threat hunting, detection engineering, or MDR/SOC environments.
• Strong knowledge of Microsoft Sentinel, Defender XDR, EDR, SIEM, identity security, cloud telemetry, email security, and modern detection techniques.
• Understanding of MITRE ATT&CK, threat actor tactics, incident response lifecycle, forensic evidence handling, and operational security workflows.
• Ability to analyze alerts, logs, IOCs, behavioural indicators, and suspicious activity to determine risk and recommend appropriate response actions.
• Experience developing detections, tuning analytics, improving alert fidelity, and creating playbooks or runbooks for repeatable response activities.
• Ability to work effectively with MDR providers, infrastructure teams, identity teams, service desk teams, legal/privacy stakeholders, and business users.
• Strong written and verbal communication skills with the ability to document investigations and explain technical findings clearly.
• Ability to remain calm under pressure and provide practical, risk-based guidance during security incidents and operational escalations.

EDUCATION, EXPERIENCE & CERTIFICATIONS

• Post-secondary education in Information Technology, Computer Science, Cybersecurity, or a related discipline, or equivalent practical experience.
• Minimum 5+ years of experience in cybersecurity operations, incident response, threat hunting, detection engineering, SOC, MDR, or related security roles.
• Hands-on experience with SIEM and XDR/EDR platforms such as Microsoft Sentinel, Microsoft Defender XDR, Splunk, QRadar, CrowdStrike, or similar technologies.
• Experience investigating phishing, malware, account compromise, endpoint compromise, suspicious authentication, cloud security alerts, and other security events.
• Experience working with MDR, MSSP, or SOC providers, including alert escalation, service quality review, reporting, or detection improvement.
• Familiarity with SOAR, automation, threat intelligence platforms, vulnerability intelligence, and security orchestration workflows is an asset.
• Familiarity with Microsoft security technologies including Defender for Endpoint, Defender for Identity, Defender for Cloud, Defender for Office 365, Entra ID, and Sentinel is preferred.
• Certifications such as GCIA, GCED, GCIH, GCFA, GNFA, CISSP, CISM, Microsoft Security, or equivalent are preferred.

We thank all applicants for their interest, however, only those selected for an interview will be contacted. This role is a new position. The target salary range for this position is $110,000 to $125,000, commensurate with the successful candidate’s skills, experience, and qualifications. Dentons is committed to equitable and competitive compensation. This target range falls within our internal salary ranges, which are based on comparable roles in the external market. We strive to hire, promote, and transfer individuals at the entry point of the range, with consideration given to prior experience, relevant skills, and market conditions. We recognize that rewarding exceptional talent goes beyond salary. Our comprehensive total rewards package includes inclusive and flexible benefits that support the wellbeing and development of our people. This includes extended health and mental health benefits, paid time off, retirement savings plans, a fitness subsidy, parental leave top-up, and more. In addition, our learning and development programs—such as mentorship opportunities, employee networks, and leadership development initiatives—are designed to support personal and professional growth. At Dentons, all candidate screening, assessment, and hiring decisions are made by people. From time to time, we use AI-enabled tools to assist in enhancing our recruitment process and materials; however, these tools do not screen candidates or make hiring decisions. Note: Availability of benefits and programs may vary depending on your location and employment type and may be subject to eligibility criteria. Dentons reserves the right to modify or discontinue offerings, in whole or in part, at its discretion and without prior notice. Equal Opportunity Statement At Dentons Canada, inclusion, diversity, equity and accessibility (IDEA) are not just ancillary values, they are foundational to our business. We believe that IDEA is essential to the shared success of our team and our clients. Our forward-thinking and inclusive culture supports the professional development of all our people, enhances the leading services we offer to our clients, and informs our commitment to make a positive impact in the communities where we live and work. As a testament to our commitment to IDEA, we have been recognized as one of Canada’s Best Diversity Employer’s for 16 consecutive years (2011-2026), as well as one of Canada’s Top Employers for Young People (2026) for the ninth time. Dentons Canada is an equal opportunity employer, and we welcome your application. All employment decisions, including hiring, will be made without regard to age, ancestry, citizenship, colour, creed, disability, ethnic origin, family status, gender identity, marital status, place of origin, race, sexual orientation, or any other characteristic protected by applicable human rights legislation. We are committed to providing you with an inclusive, barrier-free, and accessible workplace to support your success. Should you require accommodation during the recruitment process, for example as a result of a disability, please contact us at [View email address on joinrs.com](mailto:View email address on joinrs.com).