Cyber Defense Engineer

BeyondTrust, Inc.; Ottawa; On-site; CAD 90,000 - 135,000; Full time

Job summary

BeyondTrust, Inc. is seeking a Cyber Defense Engineer to join the Cyber Defense Operations team in Ottawa. You will serve as a front-line defender protecting BeyondTrust’s enterprise infrastructure and customer products, monitoring and responding to security events with a collaborative team.

You will utilize AI-assisted triage, contribute to detection rule design, and lead IR engagements from detection to remediation, aligning with MITRE ATT&CK and threat intel feeds.

Qualifications

• 4+ years in a SOC, security operations, or incident response role.
• Familiarity with MITRE ATT&CK, network protocols, and endpoint behavior.
• Strong written communication; able to document findings clearly for technical and non-technical audiences.
• Experience with at least one SIEM platform and writing search/detection queries.
• Familiarity with EDR platforms and cloud environments (IaaS preferred).
• Experience leading or co-leading complex IR engagements from triage to remediation.
• Scripting and automation skills (Python, PowerShell, or equivalent).
• Experience with identity and access management and cloud security posture management tools.
• Familiarity with SOAR platforms for automated response and enrichment.
• Experience designing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases.
• Experience building or contributing to threat intel programs or detection-as-code pipelines.
• Understanding of privileged access management landscape and threats targeting it.

Responsibilities

• Monitor, investigate, and respond to security events in a front-line role.
• Work with threat hunters, incident responders, and detection engineers in a collaborative team.
• Use AI-assisted triage and enrichment to accelerate analysis and reduce MTTD.
• Lead or participate in incident response engagements from detection through remediation.
• Conduct investigations across SIEM, EDR, CSPM and cloud-native logs for corporate and product environments.
• Develop and tune detection rules across SIEM and EDR to reduce false positives.
• Translate threat intel into actionable detection content against ATT&CK mappings.
• Contribute to IR runbooks, playbooks, and SOPs; participate in on-call rotation.
• Track operational metrics and participate in tabletop exercises.

Skills

AI systems

SOC/IR experience

MITRE ATT&CK

SIEM

EDR

Scripting (Python/PowerShell)

IAM & CSPM

SOAR

IR leadership

Threat intel

Privileged access mgmt

On-call

Communication

Tools

SIEM platforms

EDR tools

CSPM tools

Job description

• As a Cyber Defense Engineer on our Cyber Defense Operations team, you will serve as a front-line defender responsible for protecting both BeyondTrust’s enterprise infrastructure and the integrity of the products our customers depend on
• You will monitor, investigate, and respond to security events in an environment where the stakes are real and the adversaries are capable. You will work alongside experienced threat hunters, incident responders, and detection engineers in a collaborative team that values sharp analytical thinking over checkbox compliance
• This team is building toward an AI-augmented operating model. You will be expected to use AI-driven tools in your daily work and to contribute to how we integrate these capabilities into our detection, triage, and response workflows. We are not looking for people who are waiting to be told what to do—we are looking for people who want to build something
• Monitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments
• Investigate alerts to determine scope, severity, and whether escalation is warranted
• Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect
• Classify, document, and track alerts through the full lifecycle using ticketing and case management systems
• Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication
• Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs, cloud audit trails, and network flow data—spanning both corporate and product infrastructure
• Execute established IR runbooks across identity, endpoint, cloud, and email investigation workflows
• Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures
• Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences
• Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps
• Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors
• Help maintain and evolve detection coverage mapped to MITRE ATT&CK
• Partner with threat hunting peers to validate detection logic through hypothesis-driven hunts
• Use AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations
• Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows
• Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort
• Partner with engineering teams to improve log ingestion, data quality, and tool integrations
• Maintain daily operational notes and shift handoff documentation
• Contribute to and refine IR runbooks, playbooks, and standard operating procedures
• Participate in on-call rotation for after-hours incident escalation
• Track and report on operational metrics (MTTD, MTTR, MTTC, false positive rate) and identify improvement opportunities
• Participate in tabletop exercises, purple team activities, and post-incident reviews

• Comfort using AI systems (e.g., LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows
• 4+ years of experience in a SOC, security operations, or incident response role
• Understanding of common attack frameworks (MITRE ATT&CK), network protocols, and endpoint behavior
• Strong written communication skills; able to document findings clearly and concisely for both technical and non-technical audiences
• Experience with at least one SIEM platform and familiarity with writing search or detection queries
• Familiarity with EDR platforms and cloud environments (IaaS preferred)
• Experience leading or co-leading complex incident response engagements from triage through remediation
• Scripting and automation skills (Python, PowerShell, or equivalent) applied to security workflows
• Experience with identity and access management platforms and cloud security posture management tools
• Familiarity with SOAR platforms or orchestration tools for automated response and enrichment
• Experience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases
• Experience building or contributing to threat intelligence programs or detection-as-code pipelines
• Understanding of the privileged access management landscape and the threat actors that target it
• Track record of evaluating and adopting emerging technologies in a production security environment