Senior Detection Engineer II

Responsibilities

• Develop, tune, document, and maintain detection logic across endpoint, cloud, container, and SaaS log sources.
• Assist with cyber forensic investigations across varied log sources.
• Optimize log ingestion pipelines and telemetry collection for actionable security data while managing volume and cost.
• Design and build SOAR playbooks and automation workflows for detection triage, enrichment, and response.
• Mentor junior security analysts and detection engineers on threat hunting, detection logic, and investigation techniques.
• Collaborate with Engineering, Red Team, Incident Response, Fraud, and Trust & Safety teams.

Requirements

• At least 6 years of experience in detection engineering, incident response, or offensive security.
• Experience with one or more public cloud platforms, including AWS, Azure, or GCP.
• Deep understanding of attacker TTPs in modern zero trust environments, including identity compromise, token theft, and abuse of trust boundaries.
• Proficiency with macOS internals and telemetry for identifying macOS-specific threats.
• Experience implementing detection-as-code workflows with version control, peer review, automated testing, and CI/CD deployment pipelines.
• Basic proficiency with Python, Golang, or another programming language.
• Relevant certification such as GCFA, GCFE, GNFA, GREM, OSCP, GCIA, or similar.
• Preferred experience in offensive security or red teaming.
• Preferred knowledge of machine learning for threat detection.

Benefits

• Flex First work arrangement allows employees to work remotely, from an office, or from another preferred location, with regular in-person events.
• Remote hiring is currently limited to candidates in Ontario, Alberta, British Columbia, and Nova Scotia.
• The role is eligible for a new hire equity grant and annual refresh grants.
• Competitive compensation and benefits vary by permanent work location.