Senior Security Engineer, Detection and Response

Description

This is a senior security engineer role on the Security Operations and Response team, reporting to Gunnar Poling. The team builds its own AI tools to speed up investigations and improve the company's security posture.

The company runs a card issuing platform that lets businesses issue cards, authorize transactions and manage payment operations in real time. Its clients include Block, Cash App, Affirm, Instacart, DoorDash, Uber and Walmart. No payments background is required.

The hiring process is a recruiter phone or video call, a hiring manager video call, a virtual onsite of 3 to 5 interviews of 45 minutes each, and then an offer.

Responsibilities

• Lead the technical response to security events and act as the senior escalation point for North American time zones.
• Triage and investigate complex alerts as a core member of the Cybersecurity Incident Response Team.
• Build and refine detection logic across several data sources, using threat modeling to keep coverage aligned with current attacker techniques.
• Map detection coverage to show what is covered and where the blind spots are.
• Set and track KPIs with leadership, including detection effectiveness, false positive rates, and mean time to detect, respond and recover.
• Write and maintain incident response runbooks, SOPs and technical documentation.
• Create automation workflows and orchestration playbooks for detection engineering, threat hunting and incident response.
• Build and use AI-driven tools for security operations and incident response.
• Run hypothesis-driven threat hunts across corporate and production environments and help maintain the logging and monitoring that makes them possible.
• Coach junior teammates on security operations, detection engineering and incident response methods.

Requirements

• At least 5 years of hands-on security operations work, focused on incident response and detection engineering.
• Preferred: experience in threat hunting, cyber threat intelligence or digital forensics.
• Strongly preferred: certifications in incident response or a related field, such as GCIH, GCFA, GIME, OSIR or GEIR.
• Curiosity about emerging threats, attack patterns and adversary tactics, with a habit of learning about how the threat landscape changes.
• Strong investigative instincts: you dig into anomalies, follow evidence and rebuild complex incidents from incomplete data.
• You research new attack techniques and share what you learn with the security team.
• A solid grounding in security concepts, with hands-on use of EDR, NDR, CSPM, EASM, SIEM, SOAR and cloud security platforms such as GuardDuty.
• Working knowledge of MITRE ATT&CK, applied to assess detection capability and coverage gaps.
• Ability to build new detection use cases from telemetry analysis, environment baselines, actionable threat intelligence and incident findings.
• Ability to spot detection gaps across global infrastructure and work with stakeholders to improve logging and detection content.
• Strong understanding of AWS cloud services and containerization technologies.
• Nice-to-haves:
• Experience with Python, JavaScript or Go.
• Experience with Terraform or other infrastructure as code tools.
• Experience with forensic tools such as KAPE, EnCase, FTK or Volatility.
• Experience with detections-as-code tools such as Sigma or YARA.
• Experience running Purple Team exercises and writing the reports.
• Experience validating vulnerabilities or reported bugs.
• Experience with observability or SRE tools and practices.

Conditions

This is a full-time position filling an existing vacancy.

The role is remote within the province where you live, in Ontario or British Columbia, Canada.

You will join a 24x7x365 on-call rotation.

The new-hire base salary range is 136,800 to 171,000 CAD. Pay is set by skills, prior experience and work location.

Equal opportunity applies to all candidates.

Benefits

• Annual bonus for eligible employees, based on individual performance and company results.
• Several health insurance options.
• Flexible vacation time plus additional floating holidays.
• Retirement savings plan with a company contribution.
• Equity in a publicly traded company.
• Monthly stipend for the remote work setup.
• Annual development stipend for learning and growth.
• Family-forming benefits and parental leave with a top-up to base salary.