Senior Developer, Threat Defense And Detection Engineering

ABOUT US
We’re one of Canada’s largest pension investors, with CAD$320.6 billion of net assets as of March 31, 2026. We invest funds for the pension plans of the federal public service, the Canadian Forces, the Royal Canadian Mounted Police and the Reserve Force. Headquartered in Ottawa, PSP Investments has its principal business office in Montréal and offices in New York, London and Hong Kong. Capturing and leading complex global investments requires us to work as one to seize valuable opportunities, in close collaboration with some of the world’s top companies. At PSP Investments, you’ll join a team of motivated and engaged professionals, dedicated to propelling our organization further than ever before.ABOUT THE TEAM
The Security Operations Centre (SOC) is part of PSP’s Information Security team and is accountable for detecting, investigating and containing cyber threats across PSP’s global environment, from the corporate perimeter through to cloud workloads, identities and the investment platforms they support. The SOC runs a hybrid model: an in‑house team of specialists based in Montreal, supported by a managed security service provider delivering round‑the‑clock monitoring. The SOC delivers five connected services: threat defense and detection engineering, threat hunting, cyber threat intelligence, incident response and forensics, and continuous testing and teaming. Threat Defense implements the controls that detect and prevent threat actor activity targeting PSP, turning the recommendations of intelligence, hunting and testing into use cases running in production. Reporting to the Senior Manager, Security Operations Centre, you will join Threat Defense and work daily with hunters, responders, platform teams and our managed security service provider, on a stack built around Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike Falcon and Azure DevOps.ABOUT YOUR ROLE
As a Senior Developer, Threat Defense and Detection Engineering, you’ll:Detect and prevent Turn threat intelligence indicators and the recommendations of hunting, incident response and continuous testing into prioritized, estimated use casesDesign and write clean, scalable KQL detection logic for Microsoft Sentinel and Defender XDR, structured around the MITRE ATT&CK frameworkImplement preventive controls, rules and signatures in EDR/XDR and network security tools, such as custom IOA rules in CrowdStrike FalconAssess telemetry coverage and data quality with platform teams, and onboard or tune the log sources each use case depends onDeliver and support in productionTest, document and release each detection as code in Azure DevOps (version control, peer review, CI/CD), including true and false positive validationSupport detections and automations in production: handle noisy rules and connector or playbook failures, solve complex issues and provide workaroundsBring engineering support to security incidents (emergency detections, containment controls, artifact analysis) and prevent their recurrenceMeasure results against goals (recommendations implemented, active use cases, ATT&CK coverage, false positives) and steer the detection catalogueAutomate, advise and guideAutomate incident response, enrichment and vulnerability tracking (Logic Apps, Python, PowerShell, APIs), including AI-assisted SOC capabilitiesAssess exposure to zero-day vulnerabilities and misconfigurations, and support mitigation plans and Authorization and Accreditation reviewsDefine and share detection engineering standards and patterns across PSP, and review content proposed by analysts and our managed security service providerGive partner teams detailed technical recommendations, coordinate mitigation strategies, and guide analysts on KQL and detection engineeringWHAT YOU’LL NEED
A bachelor’s degree in a technical field (computer science, IT engineering or similar) or equivalent experienceA minimum of five (5) years of hands‑on cybersecurity experience, including security operations, incident response or detection engineeringProven software engineering practice within a formal delivery life cycle: Python and PowerShell, Git, code review and CI/CD (Azure DevOps or equivalent)Advanced command of Kusto Query Language (KQL): designing, optimizing and maintaining detection and hunting queries at scaleHands‑on depth with Microsoft Sentinel (analytics rules, automation rules, playbooks, data connectors, workbooks) in an enterprise environmentStrong experience creating and tuning rules, signatures and alerts in SIEM, EDR/XDR and IDS solutions, such as Defender XDR and CrowdStrike FalconWorking command of MITRE ATT&CK, cyber‑attack stages and adversary techniques, and of system, network and application vulnerabilitiesSolid knowledge of modern operating systems (Windows, Linux), TCP/IP and network security technologies, and Azure and hybrid cloud security monitoringExperience with vulnerability scanning and management, and with automating security workflows (SOAR, Logic Apps, REST APIs)Excellent communication skills, adapting messages to technical and non‑technical audiences, with rigorous documentation and mentoring habitsCertifications such as SC-200, GCIA, GCDA, GCIH, GCED or CISSP;
depth in malware analysis or threat hunting;
experience applying AI and LLM tooling to security operations;
experience in financialservices or another regulated industry are considered assetsBilingualism: English and French (frequent interactions in English with PSP employees based in our offices in Hong Kong, London and New York, and interactions in French with employees in our local offices in Montreal and Ottawa)We offer a tailored employee experience and competitive total rewards and benefits package* designed to attract and retain global diverse talent, reward performance, and reinforce business strategies and priorities. Beyond salary and incentive pay eligibility, you have access to: Investment in career development Comprehensive group insurance plans Competitive pension plans Unlimited access to virtual healthcare services and wellness programs Gender‑inclusive paid family leave policy: up to 26 weeks for primary caregivers, 5 weeks for secondary caregivers A personalized family‑building support, from pre‑pregnancy to menopause, with available financial assistance Vacation days available on day one with additional days on milestone service anniversaries, and summer Friday afternoons off A hybrid work model that includes four in‑office days, Monday through Thursday The opportunity to work temporarily from another location in accordance with the applicable policy *Benefits package may vary based on your employee type. At PSP Investments, we aim to provide a workplace where everyone feels valued, safe, respected and empowered to grow. As part of this leadership commitment, we strongly encourage applications from all qualified applicants and strive to offer an inclusive and accessible candidate experience. If you require any accommodation for any part of the recruitment process, please let us know. Visit us on Follow us on LinkedIn #LI-AO1 We’re one of Canada’s largest pension investment managers, with CAD$320.6 billion of net assets. We invest funds for the pension plans of the federal public service, the Canadian Forces, the Royal Canadian Mounted Police and the Reserve Force. We are committed to fostering an environment where experiences and learning opportunities provide you with the platform to grow. If you are having difficulty applying, you can reach us at View email address on ca.hrm.tc
#J-18808-Ljbffr