JSOC - Senior Detection Engineer (Toronto)

Senior Detection Engineer

We are looking for our next Senior Detection Engineer. Your contribution will deliver sustainable and measurable results through ownership of the detection portfolio: authoring, testing, tuning and retiring alerts that drive our organizational security outcomes. You will collaborate with SOC analysts, SIEM engineers and CTI specialists, work closely with Cybersecurity and IT teams, and contribute to process improvements and documentation for current tools. Responsibilities

Author, test, and deploy detection rules aligned to MITRE ATT&CK coverage gaps. Maintain the detection portfolio: track coverage, false‑positive rates, alert fidelity, and relevance. Validate alerts through purple‑team exercises and real‑world scenario testing. Tune detection logic to reduce false‑positive rates and improve signal‑to‑noise ratio. Document detection rationale, expected behavior, and runbook references for each alert. Build and maintain alert severity frameworks and prioritization logic. Retire stale or redundant detections with documented justification and communication. Produce monthly detection metrics: coverage by ATT&CK tactic, false‑positive trends, new vs. retired rules. Perform threat modeling to identify gaps in current detection coverage. Collaborate with SIEM engineer on platform optimization and detection rule infrastructure. Work with CTI specialists to translate threat intelligence into detection requirements. Conduct log analysis and data exploration to validate detection logic and identify edge cases. Author SIGMA rules to ensure detection portability and cross‑platform compatibility. Participate in alert tuning and optimization based on SOC analyst feedback and operational experience. Maintain runbooks and escalation procedures aligned with detection behaviors and expected outcomes. Stay current with emerging detection methodologies, tools, and MITRE ATT&CK updates. Mentor and develop team members on detection engineering best practices and frameworks. Communicate detection engineering decisions, alert changes, and coverage analysis to technical and non‑technical stakeholders. Track and report on detection engineering program metrics (rules deployed, coverage improvement, FP reduction). Qualifications

5+ years of relevant experience in detection engineering, security operations, or threat analysis in an enterprise environment. Experience authoring and deploying detection rules using Elastic Detection Rules (KQL, EQL, ES|QL). Practical experience with MITRE ATT&CK framework for detection mapping and coverage analysis. Experience tuning detection logic and reducing false‑positive rates in production environments. Experience with SIGMA rule authoring and cross‑platform detection development. Experience conducting purple‑team exercises and validating detection effectiveness. Strong log analysis and data exploration skills for identifying detection gaps and anomalies. Knowledge of threat modeling methodologies and detection requirement development. Knowledge of alert fatigue reduction strategies and signal‑to‑noise optimization. Knowledge of SIEM platform architecture, data pipelines, and detection rule deployment workflows. Experience developing and maintaining large‑scale detection portfolios. Experience with threat intelligence integration into detection workflows. Optional Credentials

GCDA, Elastic Certified Analyst, SANS SEC511, HTB CDSA or similar relevant certifications. Contributions to open‑source detection rule repositories (Elastic, Sigma). Benefits

Health & wellbeing resources and programs Paid vacation, personal, and sick days for work‑life balance Competitive compensation and benefits packages Work‑life balance in a hybrid environment – at least 3 days in office Career growth and development opportunities Opportunities to contribute to community causes Work with diverse team members in an inclusive and collaborative workplace Compensation

Base salary range: $105,000 – $116,000 (Canada) Final compensation package commensurated with experience, skills, and geographic location. Includes a comprehensive benefits plan and a competitive incentive (bonus) program for full‑time permanent roles. EEO Statement

At Questrade Financial Group of Companies, we are committed to fostering a diverse, inclusive and accessible work environment. We value the unique skills and experiences you bring and will support and motivate you to realize your unlimited potential. We are an equal‑opportunity employer and welcome applicants of all backgrounds. Candidates selected for an interview will be contacted directly. If you require accommodation during the recruitment/selection process, please let us know and we will work with you to meet your needs.

#J-18808-Ljbffr