Cyber Defense Engineer

Overview

Serve as a front-line defender on the Cyber Defense Operations team, protecting corporate infrastructure and product integrity. Monitor, investigate, and respond to security events while helping develop AI-augmented detection and response workflows.

What you'll do

• Monitor and triage alerts across SIEM, EDR, and CSPM platforms.
• Investigate incidents, collect evidence, determine root cause, and support remediation.
• Produce incident summaries and post-incident reports for technical and leadership audiences.
• Design, implement, and tune SIEM and EDR detection rules.
• Translate threat intelligence into detection content mapped to MITRE ATT&CK.
• Use and improve AI-driven tools, prompts, agent workflows, and automation pipelines.
• Maintain runbooks, handoff documentation, metrics, and participate in on-call rotations.

What you'll need

• 2+ years of experience in SOC, security operations, or incident response.
• Understanding of MITRE ATT&CK, network protocols, and endpoint behavior.
• Experience with at least one SIEM and search or detection queries.
• Familiarity with EDR platforms and cloud environments.
• Comfort using AI systems in security workflows.
• Strong written communication for technical and non-technical audiences.

Nice to have

• Experience leading complex incident response engagements.
• Identity and access management or cloud security posture management experience.
• Python, PowerShell, or equivalent security automation skills.
• SOAR, threat intelligence, detection-as-code, or AI agent architecture experience.

Details

• Remote in Canada or the United States.
• Participation in an after-hours incident escalation on-call rotation.