SOC Engineering & Detection Capability Leadership

• Accountable for the overall effectiveness, maturity, and continuous evolution of SOC capabilities, including SIEM platforms, detection engineering, and supporting security technologies such as Endpoint Protection.

• Establishes andmaintainsengineering standards, governance, methodologies, and operational processes.

• Ensures detection coverage is comprehensive, effective, and aligned to the organization's risk profile and threat landscape.

• Partners with Incident Response and Threat Intelligence teams to continuously enhance detection capabilities, improve visibility, and strengthen investigative readiness.

Security Monitoring Platforms & Data Management

• Owns the architecture, integration, performance, and reliability of security monitoring platforms and supporting infrastructure.

• Ensures security data pipelines, logging, telemetry, and ingestion capabilities provide comprehensive and actionable visibility across the enterprise.

• Establishes standards for data quality, normalisation, enrichment, and coverage to support effective threat detection and investigation.

• Collaborates with technology and engineering teams to ensure systems, applications, and services are integrated into security monitoring and detection capabilities.

Incident Response & Detection Validation

• Provides technical leadership and engineeringexpertiseduring cyber security incidents, investigations, and threat containment activities.

• Oversees the design, development, tuning, and optimisation of threat detection use cases aligned to evolving threat actor tactics, techniques, and procedures (TTPs).

• Validates the effectiveness of detection controls through testing, simulation, and continuous assessment.

• Supports red team, purple team, adversary emulation, and attack simulation exercises toidentifygaps and improve detection and response capabilities.

• Works closely with stakeholders to ensure lessons learned from incidents are incorporated into detection strategies and engineering improvements.

Continuous Improvement & Strategic Capability Development

• Own the strategy and roadmap for SOC engineering, detection engineering, and security operations capabilities.

• Drives the ongoing enhancement of SOC engineering capabilities through automation, process optimisation, and technology innovation.

• Evaluates emerging technologies, industry trends, and leading practices to strengthen the organization's security monitoring and detection posture.

• Identifiesopportunities to improve operational resilience, scalability, efficiency, and overall security effectiveness.

WhatYou Bring:

• Minimum 7 years of experience in cybersecurity engineering, security operations, or a related discipline, including experience owning or leading cybersecurity platforms, services, or capabilities.

• Strong experience with security monitoring, detection engineering, incident response, and threat intelligence, including the development and optimisation of detection use cases aligned to threat actor behaviours and the MITRE ATT&CK framework.

• Hands-on experience with enterprise security technologies, including SIEM, EDR/XDR/NDR, security data pipelines, logging, and monitoring solutions.

• Strong understanding of network security, TCP/IP, systems hardening, cloud security, and modern cybersecurity architectures.

• Experience leading security platform transformations, migrations, or capability modernization initiatives within complex enterprise environments.

• Proven ability to collaborate effectively with cross-functional teams, influence stakeholders, manage competing priorities, and communicate technical concepts to both technical and non-technical audiences.

• Government of Canada Secret (Level II) clearance, or eligibility to obtain and maintain clearance.

• Industry certifications such as CISSP, CCSP, CISM, CISA, CEH, OSCP, or equivalent are considered an asset.