Engineer - Security Operations and Incident Response

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Engineer - Security Operations and Incident Response based in Canada.

This role is central to strengthening and continuously evolving a global Security Operations and Incident Response program.
You will help protect enterprise environments by identifying, investigating, containing, and eradicating sophisticated cybersecurity threats.
The position combines deep technical investigations with detection engineering, threat intelligence, automation, and incident response.
You will work across hybrid cloud environments while improving security processes, technologies, and operational resilience.
Your expertise will help close visibility gaps, strengthen detection capabilities, and reduce risk across the organization.
You will also contribute to playbooks, threat models, documentation, and continuous optimization of SOC tooling and workflows.
This is an opportunity to make a direct impact on enterprise security while working with advanced cybersecurity technologies and frameworks.

• Conduct expert-level investigations into complex security incidents, including digital forensics involving memory, network traffic, and malware analysis.
• Develop, author, and continuously refine incident response playbooks and operational guidelines to ensure effective responses to evolving threats.
• Develop and maintain threat models, incorporating penetration testing findings into detection strategies and security improvements.
• Design, implement, and optimize sophisticated detection rules and automated remediation workflows to identify and respond to adversarial behavior.
• Leverage threat intelligence and the MITRE ATT&CK framework to identify visibility gaps and proactively mitigate emerging cybersecurity risks.
• Maintain comprehensive documentation covering detection strategies, active investigations, incident timelines, and response activities.
• Partner with SIEM teams to continuously tune detection rules, improving detection fidelity while minimizing false positives and alert fatigue.
• Review and optimize threat intelligence capabilities, including brand protection and dark web monitoring systems.
• Develop scripts and queries using technologies such as Python, XQL, PowerShell, and Bash to support security investigations and operational efficiency.
• Implement and maintain automation and orchestration capabilities through SOAR tools and related technologies.
• Support incident response leadership as a backup resource for incident response activities and operational priorities.
• Contribute to the continuous improvement of security operations processes, technologies, and overall incident response maturity.

Requirements:

• Bachelor's degree and at least 5 years of relevant professional experience in incident response and Security Operations Center (SOC) tooling.
• In-depth knowledge of SIEM and SOAR platforms, with experience in technologies such as Microsoft Sentinel, Palo Alto Cortex XSIAM, and Cortex XSOAR.
• Strong understanding of incident response processes within hybrid cloud environments, including GCP and Azure.
• Experience serving as an incident commander during security incidents and leading coordinated response efforts.
• Proven ability to conduct root cause analysis and drive continuous optimization of SOC tools, processes, and detection capabilities.
• Strong scripting and query-building skills using Python, PowerShell, Bash, and/or XQL.
• Understanding of cybersecurity frameworks and regulatory requirements, including MITRE ATT&CK, NIST, and ISO.
• Experience with threat intelligence, detection engineering, security automation, and incident response processes.
• Strong analytical and problem-solving skills, with the ability to investigate complex security events and develop practical solutions.
• Ability to prioritize effectively, manage multiple concurrent priorities, and work independently as well as collaboratively.
• Excellent written and verbal communication skills, including the ability to translate sophisticated technical security concepts into clear, concise business-focused explanations.

Benefits:

• Remote or hybrid work options.
• Opportunity to work on the ongoing transformation of a global Security Operations and Incident Response program.
• Exposure to advanced cybersecurity technologies, including SIEM, SOAR, threat intelligence, security automation, and cloud security platforms.
• Opportunity to work with modern security frameworks and methodologies such as MITRE ATT&CK, NIST, and ISO.
• High-impact role focused on strengthening enterprise resilience and protecting against evolving cybersecurity threats.
• Opportunity to contribute to continuous process improvement and the advancement of security operations capabilities.