AI-Driven Cyber Defense Engineer - IR & Threat Detection

BeyondTrust, Inc.; Ottawa; On-site; CAD 90,000 - 135,000; Full time

Job summary

BeyondTrust, Inc. is seeking a Cyber Defense Engineer to join the Cyber Defense Operations team in Ottawa. You will serve as a front-line defender protecting BeyondTrust’s enterprise infrastructure and customer products, monitoring and responding to security events with a collaborative team.

You will utilize AI-assisted triage, contribute to detection rule design, and lead IR engagements from detection to remediation, aligning with MITRE ATT&CK and threat intel feeds.

Qualifications

• 4+ years in a SOC, security operations, or incident response role.
• Familiarity with MITRE ATT&CK, network protocols, and endpoint behavior.
• Strong written communication; able to document findings clearly for technical and non-technical audiences.
• Experience with at least one SIEM platform and writing search/detection queries.
• Familiarity with EDR platforms and cloud environments (IaaS preferred).
• Experience leading or co-leading complex IR engagements from triage to remediation.
• Scripting and automation skills (Python, PowerShell, or equivalent).
• Experience with identity and access management and cloud security posture management tools.
• Familiarity with SOAR platforms for automated response and enrichment.
• Experience designing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases.
• Experience building or contributing to threat intel programs or detection-as-code pipelines.
• Understanding of privileged access management landscape and threats targeting it.

Responsibilities

• Monitor, investigate, and respond to security events in a front-line role.
• Work with threat hunters, incident responders, and detection engineers in a collaborative team.
• Use AI-assisted triage and enrichment to accelerate analysis and reduce MTTD.
• Lead or participate in incident response engagements from detection through remediation.
• Conduct investigations across SIEM, EDR, CSPM and cloud-native logs for corporate and product environments.
• Develop and tune detection rules across SIEM and EDR to reduce false positives.
• Translate threat intel into actionable detection content against ATT&CK mappings.
• Contribute to IR runbooks, playbooks, and SOPs; participate in on-call rotation.
• Track operational metrics and participate in tabletop exercises.

Skills

AI systems

SOC/IR experience

MITRE ATT&CK

SIEM

EDR

Scripting (Python/PowerShell)

IAM & CSPM

SOAR

IR leadership

Threat intel

Privileged access mgmt

On-call

Communication

Tools

SIEM platforms

EDR tools

CSPM tools

Job description

BeyondTrust, Inc. is seeking a Cyber Defense Engineer to join the Cyber Defense Operations team in Ottawa. You will serve as a front-line defender protecting BeyondTrust’s enterprise infrastructure and customer products, monitoring and responding to security events with a collaborative team.

You will utilize AI-assisted triage, contribute to detection rule design, and lead IR engagements from detection to remediation, aligning with MITRE ATT&CK and threat intel feeds.