Threat detection specialist governing MDR, engineering detections, and responding to cyber incidents. Strengthening cyber resilience across Dentons Canada’s legal technology environment.
About the role
- Threat detection specialist governing MDR, engineering detections, and responding to cyber incidents. Strengthening resilience for Dentons Canada’s global legal services environment.
Responsibilities
- Govern the Managed Detection and Response service, ensuring high-quality monitoring, escalation, investigation support, reporting, and continuous improvement
- Develop, tune, and maintain high-fidelity detection use cases across Microsoft Sentinel, Defender XDR, identity, endpoint, cloud, email, and network telemetry
- Improve detection coverage using MITRE ATT&CK, threat intelligence, incident learnings, audit findings, and control-gap analysis
- Work with the MDR provider to reduce false positives, validate alerts, improve escalation quality, and ensure visibility into priority threats
- Support log-source onboarding, detection coverage assessments, analytics development, dashboarding, and operational reporting
- Develop and maintain detection logic, response playbooks, and automation workflows
- Conduct proactive threat hunting using SIEM, EDR/XDR, identity, cloud, email, network, and other telemetry sources
- Triage, investigate, and respond to escalated security alerts, incidents, and suspected compromise activity
- Act as technical responder for phishing, malware, account compromise, endpoint compromise, insider threat, suspicious access, and cloud security events
- Support containment, eradication, recovery, forensic evidence collection, incident timelines, and post-incident reviews
- Translate incident findings into improved detections, response procedures, preventive controls, and security-awareness actions
- Participate in incident tabletop exercises, purple-team exercises, and response-readiness activities
- Monitor emerging threats relevant to professional services and legal environments
- Convert threat intelligence into detection use cases, hunting hypotheses, playbook improvements, and preventive recommendations
- Produce operational threat reports, detection-coverage summaries, incident trends, and metrics for Security leadership and stakeholders
- Collaborate with security design and cloud/vulnerability specialists to inform architecture, configuration, and exposure-reduction priorities
- Identify opportunities for SOAR, automation, AI-assisted investigation, and process improvement
- Support escalated phishing investigations, security mailbox inquiries, high-risk URL or web-filtering requests, DLP alerts, exception reviews, and operational security tickets
- Provide coaching, quality review, and technical guidance to the Security Services function
- Document operational work through runbooks, knowledge articles, automation, and clear escalation criteria
Requirements
- Post-secondary education in Information Technology, Computer Science, Cybersecurity, or a related discipline, or equivalent practical experience
- Minimum 5+ years of experience in cybersecurity operations, incident response, threat hunting, detection engineering, SOC, MDR, or related security roles
- Hands-on experience with SIEM and XDR/EDR platforms such as Microsoft Sentinel, Microsoft Defender XDR, Splunk, QRadar, CrowdStrike, or similar technologies
- Experience investigating phishing, malware, account compromise, endpoint compromise, suspicious authentication, cloud security alerts, and other security events
- Experience working with MDR, MSSP, or SOC providers, including alert escalation, service quality review, reporting, or detection improvement
- Familiarity with SOAR, automation, threat intelligence platforms, vulnerability intelligence, and security orchestration workflows is an asset
- Familiarity with Microsoft security technologies including Defender for Endpoint, Defender for Identity, Defender for Cloud, Defender for Office 365, Entra ID, and Sentinel is preferred
- Certifications such as GCIA, GCED, GCIH, GCFA, GNFA, CISSP, CISM, Microsoft Security, or equivalent are preferred
- Strong knowledge of Microsoft Sentinel, Defender XDR, EDR, SIEM, identity security, cloud telemetry, email security, and modern detection techniques
- Understanding of MITRE ATT&CK, threat actor tactics, incident response lifecycle, forensic evidence handling, and operational security workflows
- Ability to analyze alerts, logs, IOCs, behavioural indicators, and suspicious activity to determine risk and recommend appropriate response actions
- Experience developing detections, tuning analytics, improving alert fidelity, and creating playbooks or runbooks for repeatable response activities
- Ability to work effectively with MDR providers, infrastructure teams, identity teams, service desk teams, legal/privacy stakeholders, and business users
- Strong written and verbal communication skills with the ability to document investigations and explain technical findings clearly
- Ability to remain calm under pressure and provide practical, risk-based guidance during security incidents and operational escalations
Benefits
- Extended health benefits
- Mental health benefits
- Paid time off
- Retirement savings plans
- Fitness subsidy
- Parental leave top-up
- Mentorship opportunities
- Employee networks
- Leadership development initiatives
- Inclusive and flexible benefits
- Accommodation during the recruitment process
Job title
Job type
Experience level
Salary
Degree requirement
No Education Requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Operations Analyst analyzing Uline’s shipping, industrial, and packaging distribution data. Developing SQL and Power BI reporting to improve branch performance and operations.
Research Operations Lead building and scaling Mercury's customer research operations for fintech products. Owning research panels, tools, ethical processes, AI workflows, and team coaching.
Desjardins IT analyst automating, securing, and maintaining systems and infrastructure. Diagnosing platform issues and developing operational methods, tools, and processes.
Legal Operations Analyst managing contract operations, legal technology, and outside counsel billing. Improving AI - assisted workflows at Docker, a developer tooling company.
Legal Operations Manager scaling legal systems, processes, and vendor operations for Caseware’s global audit and accounting software business. Supporting a four - lawyer in - house team from Toronto.
Operations Manager leading warehouse teams, client relationships, and operational performance for DSV, a global transport and logistics company. Ensuring contractual compliance, delivery quality, forecasting, and labor planning.
Jr. Manufacturing Operations Engineer improving procedures, tooling, and quality for Arbutus Medical’s procedure kits. Supporting reliable medical device production through SolidWorks and hands - on troubleshooting.
Staff AI Operations Lead shipping governed AI workflows across Honeycomb.io’s business operations. Building shared AI infrastructure, enablement, and adoption on the Data team.
Strategy and operations manager running cadence, metrics, contracts, and risk for FutureFit AI. Supporting leadership decisions at a SaaS/AI workforce development company.