Information Security Analyst (Detection Engineer)

Work location and hours

• The listed work location is Toronto, Ontario, Canada.
• The posting lists 37.5 hours; no cadence for those hours is specified.

Pay details

• The stated pay range is $69,700–$98,400 CAD; the posting does not specify a pay period.

Role overview

Key responsibilities

• Develop, review, tune, and maintain detections across SIEM and security monitoring platforms.
• Analyze security events, alerts, and telemetry to identify suspicious activity, detection gaps, and improvement opportunities.
• Improve alert fidelity, reduce unnecessary noise, and keep detections useful for security operations.
• Use Microsoft Sentinel, Microsoft Defender products, Microsoft Entra ID, and Splunk for threat detection, investigations, and tuning.
• Apply knowledge across identity, endpoint, cloud, network, email, and application security.
• Collaborate with SOC, incident response, security engineering, and technology teams.
• Document detection logic, assumptions, data sources, tuning decisions, and investigation guidance.
• Assess detection relevance, actionability, coverage, and operational value.

Required qualifications

• Experience in cybersecurity, security monitoring, SOC operations, incident response, threat hunting, or detection engineering.
• Hands-on experience with Splunk and Microsoft Sentinel and familiarity with the Microsoft security suite.
• Ability to review or support SIEM-based detections and investigations.
• Strong cybersecurity fundamentals, including attack techniques, security controls, incident investigation, and risk-based thinking.
• Familiarity with cloud security, identity, access, logging, monitoring, and misconfiguration risks.
• Understanding of security telemetry from identity, endpoint, network, email, cloud, and application environments.
• Ability to judge whether alerts are accurate, actionable, and useful for security operations.
• Strong analytical, troubleshooting, communication, and documentation skills; ability to work with cross-functional technical teams.

Preferred qualifications

• KQL, SPL, or other security query language experience is preferred.
• Microsoft Defender XDR and related Defender product experience is preferred.
• Experience with SentinelOne or similar endpoint detection and response platforms is preferred.
• MITRE ATT&CK, threat intelligence, attack paths, or adversary behavior analysis familiarity is preferred.
• Detection lifecycle management, detection-as-code, automation, SOAR, version control, and Python or PowerShell experience are preferred.
• Experience in a regulated, financial services, or large enterprise environment is preferred.