Staff Specialist, Security Operations

Workleap

. Build the end-to-end security operations pipeline, including alert integrations, triage, enrichment, correlation, investigation authoring, and routing results to Jira .

Posted 10/26/2026full-timeRemote • CanadaLead💰 CA$125,000 - CA$160,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in security operations and incident response, with a strong focus on detection engineering and the ability to collaborate effectively with development teams. Proficient in building and deploying security agent systems and utilizing detection-as-code engineering within cloud-based environments.

Highest-signal resume keywords

Security OperationsIncident ResponseDetection EngineeringCloud-Based SaaS ExperienceDetection-As-Code Engineering

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseDetection EngineeringSecurity OperationsFalse Positive EliminationSecurity Agent SystemsSIEM Query LanguageEvaluations of Agent OutputsIdentity-Based Attack PathsCloud-Based Attack PathsThreat Hunting

Soft Skills

CollaborationDecision Making

Tools & Technologies

MCP ServersClaude SkillsJiraAzureEntra ID

Industry Keywords

MITRE ATT&CKManaged DetectionForensicsPrompt InjectionPermission Management

Tech Stack

Tools & technologies

AzureCloudFlux

About the role

Key responsibilities & impact

Build the end-to-end security operations pipeline, including alert integrations, triage, enrichment, correlation, investigation authoring, and routing results to Jira
Define the agent trust model, including evaluations, safeguards against prompt injection, and permission abuse
Eliminate false positives and poorly assessed findings from security tools
Lead detection-as-code engineering aligned with MITRE ATT&CK
Lead incident response from triage through postmortem
Oversee the managed detection partner’s performance against measurable criteria
Deliver security findings into development team workflows with evidence and a remediation path
Build detection and response agents and demonstrate their reliability
Collaborate with the Director of Infrastructure and Security, the Staff Application Security Specialist, the Security Tooling team, Infrastructure, ITX, and Product Engineering

Requirements

What you’ll need

English proficiency is required
7+ years of experience in security operations, incident response, or detection engineering
Recent hands-on experience in a cloud-based SaaS environment
Strong experience validating findings, eliminating false positives, and making decisions based on incomplete evidence
Experience working directly with development teams and delivering fixes without formal authority
Experience building and deploying security agent systems, such as MCP servers, Claude Skills, or custom tools
Experience with evaluations that determine the reliability of agent outputs
Understanding of failures and attacks affecting agentic systems, including prompt injection and permission and credential management
Proficiency in detection-as-code engineering and a SIEM query language
Strong understanding of identity- and cloud-based attack paths, ideally in Azure and Entra ID
Experience leading a managed detection partner, threat hunting, or forensics experience is an asset
French proficiency is an asset

Benefits

Comp & perks

Annual bonus program
LTIP, offering participation in Workleap’s long-term growth
RRSP
Family group insurance
Telemedicine
Annual wellness budget
Flexible vacation policy
Remote work, with access to the Montreal offices
In-person gatherings twice a year
Claude available to everyone