Staff Security Engineer, AI-Driven Detection – Response

Fullscript

. Define and drive Fullscript’s defensive threat detection, incident response, and AI-assisted SecOps capability across cloud infrastructure, identity, endpoints, and application ecosystems .

Posted 10/15/2026full-timeRemote • CanadaLeadWebsite

Tech Stack

Tools & technologies

AWSCloudJavaScriptPythonTerraform

About the role

Key responsibilities & impact

Define and drive Fullscript’s defensive threat detection, incident response, and AI-assisted SecOps capability across cloud infrastructure, identity, endpoints, and application ecosystems
Set multi-quarter technical direction for detection and response across Security, Platform, and Engineering teams
Architect, author, maintain, test, tune, and retire detection logic across SIEM, cloud infrastructure, identity systems, endpoint protection, and AI/ML pipelines
Establish detection coverage and defensive controls against AI and agentic threat vectors, including prompt injection, tool misuse, and data exfiltration
Measure detection coverage, precision, false-positive rate, and time-to-detect
Create dashboards and reporting for alert volume, response times, and trends
Design and deploy AI-assisted investigation workflows using LLMs and automated agents
Build and extend internal security tooling for identity resolution, cross-source log correlation, and natural-language security telemetry queries
Automate handoffs between detection tooling and ticketing systems
Lead and support security investigations from triage through containment and resolution
Mentor Security Operations team members and establish standards for rule quality, detection-as-code, and investigation rigor
Partner with business teams to investigate and remediate security escalations
Maintain and improve incident response playbooks
Participate in an on-call rotation outside business hours
Threat model systems, AI agents, and services
Lead defensive testing, purple-teaming, and adversarial validation exercises
Ensure AI services and features expose necessary logging and telemetry
Evaluate authorization and access-control changes and drive remediation
Operationalize threat intelligence into actionable detections and tracked follow-up work
Coordinate IOC blocking across endpoint, network, and web layers

Requirements

What you’ll need

8+ years of experience in detection engineering, incident response, or security engineering, with demonstrated leadership in shaping organizational security strategy
Practical experience incorporating AI tooling into SecOps workflows and familiarity with detection strategies for AI-specific threat vectors
Strong scripting/automation skills in Python, JavaScript, or similar
Experience building workflows in a SOAR-style or workflow automation platform
Experience managing security controls as code, such as Terraform, through peer review rather than manual console changes
Experience securing cloud environments, preferably AWS, and modern SaaS/identity stacks
Hands-on incident response experience: triage, investigation, containment, and postmortem/playbook development
Working knowledge of adversary tradecraft, including MITRE ATT&CK, and ability to translate it into practical, tuned detections
Ability to partner directly with engineering and infrastructure teams to define telemetry and control requirements
Excellent written communication
Experience contributing to or building from open detection content, such as Sigma rules or community rule repositories (bonus)
Experience collaborating with red/purple-team exercises to validate detection coverage (bonus)
Experience supporting a healthcare, regulated, or highly sensitive-data environment (bonus)
Relevant certifications such as GCIH, GCFA, GCTI, or GCDA, or equivalent practical experience (bonus)

Benefits

Comp & perks

Generous PTO and competitive pay
Fullscript’s RRSP match program for financial health
Flexible benefits package and workplace wellness program
Training budget and company-wide learning initiatives
Discount on Fullscript catalog of products
Ability to work in-office, at home, or a combination of both under the Wherever You Work Well philosophy