IT Threat Operations – Detection Specialist

Dentons

. Govern the Managed Detection and Response service, ensuring high-quality monitoring, escalation, investigation support, reporting, and continuous improvement .

Posted 10/14/2026full-timeToronto • CanadaMid-LevelSenior💰 CA$110,000 - CA$125,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cybersecurity operations, incident response, and threat hunting, with a strong focus on developing and maintaining detection use cases and response playbooks. Proficient in utilizing Microsoft Sentinel, Defender XDR, and SIEM technologies to enhance security monitoring and incident management.

Highest-signal resume keywords

Cybersecurity OperationsIncident ResponseThreat HuntingMicrosoft SentinelDetection Engineering

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection Use CasesIncident Response LifecycleAlert TuningForensic Evidence HandlingSecurity MonitoringThreat Intelligence AnalysisAutomation WorkflowsPhishing InvestigationCloud SecuritySIEM Technologies

Soft Skills

Strong Communication SkillsCalm Under PressureCoaching and Guidance

Tools & Technologies

Microsoft Defender XDRSplunkQRadarCrowdStrikeSOAR PlatformsMicrosoft Security Technologies

Certifications & Qualifications

GCIAGCEDGCIHGCFAGNFACISSPCISM

Industry Keywords

MDRSOCMITRE ATT&CKOperational SecurityThreat Actor Tactics

Tech Stack

Tools & technologies

CloudCyber SecuritySplunk

About the role

Key responsibilities & impact

Govern the Managed Detection and Response service, ensuring high-quality monitoring, escalation, investigation support, reporting, and continuous improvement
Develop, tune, and maintain high-fidelity detection use cases across Microsoft Sentinel, Defender XDR, identity, endpoint, cloud, email, and network telemetry
Improve detection coverage using MITRE ATT&CK, threat intelligence, incident learnings, audit findings, and control-gap analysis
Work with the MDR provider to reduce false positives, validate alerts, improve escalation quality, and ensure visibility into priority threats
Support log-source onboarding, detection coverage assessments, analytics development, dashboarding, and operational reporting
Develop and maintain detection logic, response playbooks, and automation workflows
Conduct proactive threat hunting using SIEM, EDR/XDR, identity, cloud, email, network, and other telemetry sources
Triage, investigate, and respond to escalated security alerts, incidents, and suspected compromise activity
Act as technical responder for phishing, malware, account compromise, endpoint compromise, insider threat, suspicious access, and cloud security events
Support containment, eradication, recovery, forensic evidence collection, incident timelines, and post-incident reviews
Translate incident findings into improved detections, response procedures, preventive controls, and security-awareness actions
Participate in incident tabletop exercises, purple-team exercises, and response-readiness activities
Monitor emerging threats relevant to professional services and legal environments
Convert threat intelligence into detection use cases, hunting hypotheses, playbook improvements, and preventive recommendations
Produce operational threat reports, detection-coverage summaries, incident trends, and metrics for Security leadership and stakeholders
Collaborate with security design and cloud/vulnerability specialists to inform architecture, configuration, and exposure-reduction priorities
Identify opportunities for SOAR, automation, AI-assisted investigation, and process improvement
Support escalated phishing investigations, security mailbox inquiries, high-risk URL or web-filtering requests, DLP alerts, exception reviews, and operational security tickets
Provide coaching, quality review, and technical guidance to the Security Services function
Document operational work through runbooks, knowledge articles, automation, and clear escalation criteria

Requirements

What you’ll need

Post-secondary education in Information Technology, Computer Science, Cybersecurity, or a related discipline, or equivalent practical experience
Minimum 5+ years of experience in cybersecurity operations, incident response, threat hunting, detection engineering, SOC, MDR, or related security roles
Hands-on experience with SIEM and XDR/EDR platforms such as Microsoft Sentinel, Microsoft Defender XDR, Splunk, QRadar, CrowdStrike, or similar technologies
Experience investigating phishing, malware, account compromise, endpoint compromise, suspicious authentication, cloud security alerts, and other security events
Experience working with MDR, MSSP, or SOC providers, including alert escalation, service quality review, reporting, or detection improvement
Familiarity with SOAR, automation, threat intelligence platforms, vulnerability intelligence, and security orchestration workflows is an asset
Familiarity with Microsoft security technologies including Defender for Endpoint, Defender for Identity, Defender for Cloud, Defender for Office 365, Entra ID, and Sentinel is preferred
Certifications such as GCIA, GCED, GCIH, GCFA, GNFA, CISSP, CISM, Microsoft Security, or equivalent are preferred
Strong knowledge of Microsoft Sentinel, Defender XDR, EDR, SIEM, identity security, cloud telemetry, email security, and modern detection techniques
Understanding of MITRE ATT&CK, threat actor tactics, incident response lifecycle, forensic evidence handling, and operational security workflows
Ability to analyze alerts, logs, IOCs, behavioural indicators, and suspicious activity to determine risk and recommend appropriate response actions
Experience developing detections, tuning analytics, improving alert fidelity, and creating playbooks or runbooks for repeatable response activities
Ability to work effectively with MDR providers, infrastructure teams, identity teams, service desk teams, legal/privacy stakeholders, and business users
Strong written and verbal communication skills with the ability to document investigations and explain technical findings clearly
Ability to remain calm under pressure and provide practical, risk-based guidance during security incidents and operational escalations

Benefits

Comp & perks

Extended health benefits
Mental health benefits
Paid time off
Retirement savings plans
Fitness subsidy
Parental leave top-up
Mentorship opportunities
Employee networks
Leadership development initiatives
Inclusive and flexible benefits
Accommodation during the recruitment process