Senior Manager leading BDO Canada’s cybersecurity monitoring, threat detection, incident response, and security team. Driving operational risk reduction across enterprise and cloud environments.
About the role
- Staff Security Operations Specialist automating threat detection and incident response across Workleap and ShareGate. Building trusted security agents and detection pipelines for a workplace software company.
Responsibilities
- Own how Workleap detects, investigates and responds to threats across Workleap and ShareGate
- Build the end-to-end security operations pipeline, including alert integrations, agentic triage, enrichment, correlation and investigation drafting
- Connect investigation results to Jira with evidence and remediation paths
- Define the trust model for security agents, including autonomous closures, recommendations and human escalation
- Develop evaluations and secure agents against prompt injection and permission abuse
- Reduce false positives and improve finding prioritization
- Own detection engineering as code mapped to MITRE ATT&CK
- Lead security incident response from triage through postmortem
- Manage performance expectations for the managed detection partner
- Deliver actionable security findings to developers in their workflow
- Report to the Director of Infrastructure and Security and collaborate with application security, security tooling, infrastructure, ITX and product engineering teams
Requirements
- 7+ years in security operations, incident response or detection engineering, with recent hands-on time in a cloud SaaS environment
- Deep experience validating tooling findings, tuning false positives, and making decisions with incomplete evidence
- Years of working directly with developers and getting fixes shipped without authority
- Built and shipped agent systems for security work, such as MCP servers, Claude skills, subagents or custom tools, with evals that determine when output is trusted
- Working model of agentic-system failures and attacks, including prompt injection, tool permission scoping and credential handling
- Detection engineering experience, including detections as code, fluent SIEM query language use, and measuring false-positive rates
- Strong grasp of identity and cloud attack paths, ideally in Azure and Entra ID
- Bonus: experience directing a managed detection partner, threat hunting or forensics, and working proficiency in French
Benefits
- Annual bonus program
- LTIP program, share in Workleap's long-term growth
- RRSP
- Family health insurance
- Telemedicine
- Annual wellness budget
- Flexible vacation policy
- Remote work, with access to our Montreal office
- In-person gatherings twice a year
- Claude access, for everyone
Job title
Job type
Experience level
Salary
Degree requirement
No Education Requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Senior Manager leading BDO Canada's security operations, threat detection, and incident response. Managing cyber risk, security capabilities, and a high - performing cybersecurity team.
Senior security leader directing global investigations and incident response for Affirm’s transparent fintech payment platform. Building scalable response, AI - enabled workflows, and executive risk reporting.
Senior security leader directing Affirm’s global incident response and investigations. Building scalable detection, readiness, and AI - enabled security capabilities for fintech payments.
SOC Detection & Response Specialist developing SIEM detections, SOAR playbooks, and incident - response workflows. Supporting Sopra Steria’s consulting, digital services, and software - development clients.
Staff Security Operations Specialist building AI - powered threat detection and response for ShareGate, a Microsoft 365 migration and governance platform. Automating triage, investigations and developer remediation workflows.
Spécialiste Staff en opérations de sécurité chez Workleap, éditeur de logiciels de travail et de migration Microsoft 365. Automatisation de la détection, des enquêtes et de la réponse par des agents IA.
Security Engineer building LiveKit’s vulnerability management and security operations program. Securing infrastructure for the company’s voice, video, and AI application platform.
Junior SOC Analyst monitoring and responding to security incidents for Long View, a North American IT services provider. Supporting SIEM operations, cloud security, incident escalation, and 24x7 coverage.
Tier 1 Security Consultant monitoring and investigating cyber threats for TELUS’s national cybersecurity operations. Handling SOC alerts, incident response, escalations, and security reporting.