Cybersecurity Detection Engineer / Purple Team

act digital; Montreal (administrative region); On-site; CAD 90,000 - 130,000; Full time

Job summary

Act Digital, Montreal-based international technology and cybersecurity consulting, is seeking a Detection Engineer to strengthen detection capabilities in a major financial-sector environment. You will work with SOC, Incident Response and Security Engineering teams on detection engineering, purple teaming and offensive validation to improve coverage and defensive maturity.

The role focuses on reviewing use cases, building new detections, validating through adversary simulation, and reducing

Qualifications

• 3+ years of cybersecurity experience.
• Experience in Detection Engineering, Threat Detection, SOC or Purple Teaming.
• Hands-on experience with offensive security techniques or adversary simulation.
• Experience working in enterprise or regulated environments.
• Strong understanding of modern attack techniques and intrusion methodologies.

Responsibilities

• Reviewing and improving existing detection use cases
• Developing new detection logic and behavioral analytics
• Validating detections through offensive testing and adversary simulation
• Identifying detection gaps across endpoint, identity, network and cloud environments
• Simulating attacker techniques mapped to MITRE ATT&CK
• Improving detection quality and reducing false positives
• Supporting continuous improvement of monitoring and response capabilities

Skills

SIEM & EDR

Detection use case development

MITRE ATT&CK

Log analysis

Offensive security fundamentals

Python/PowerShell/Bash

Windows security

Active Directory knowledge

Investigation capabilities

Job description

Act Digital is an international technology and cybersecurity consulting company supporting major organizations across digital transformation, cyber defense and security operations.

Within our cybersecurity activities, we support large enterprise and financial-sector clients on topics including:

• SOC operations
• Offensive security
• Purple teaming

We are currently looking for a Detection Engineer to join a major financial-sector environment in Montreal.

About the Role

As a Detection Engineer, you will help improve and validate cybersecurity detection capabilities against modern attacker techniques.

This role combines detection engineering, purple teaming and offensive validation activities. The objective is not only to create detections, but also to continuously test and improve their effectiveness against realistic attack scenarios.

You will work closely with SOC, Incident Response and Security Engineering teams to strengthen detection coverage and defensive maturity across the environment.

Main responsibilities include:

• Reviewing and improving existing detection use cases
• Developing new detection logic and behavioral analytics
• Validating detections through offensive testing and adversary simulation
• Identifying detection gaps across endpoint, identity, network and cloud environments
• Simulating attacker techniques mapped to MITRE ATT&CK
• Improving detection quality and reducing false positives
• Supporting continuous improvement of monitoring and response capabilities

Qualifications

• 3+ years of experience in cybersecurity
• Experience in Detection Engineering, Threat Detection, SOC or Purple Teaming
• Hands-on experience with offensive security techniques or adversary simulation
• Experience working in enterprise or regulated environments
• Strong understanding of modern attack techniques and intrusion methodologies

Required Skills

• SIEM and EDR technologies
• Detection use case development and tuning
• MITRE ATT&CK framework
• Log analysis and event correlation
• Offensive security fundamentals
• Scripting skills (Python, PowerShell and/or Bash)
• Windows security and Active Directory knowledge
• Strong analytical and investigation capabilities

Preferred Skills

• Experience in financial or highly regulated environments
• Experience with purple teaming or adversary simulation
• Experience with detection-as-code methodologies
• Knowledge of threat hunting methodologies
• Familiarity with Windows internals, Active Directory and cloud environments
• Knowledge of modern attack chains, lateral movement and privilege escalation techniques