Senior Developer, Threat Defense and Detection Engineering

PSP Investments; Montreal; Hybrid; CAD 110,000 - 160,000; Full time

Benefits offered by this job

Hybrid work model

Competitive pension plans

Group insurance plans

Wellness programs

Vacation days from day one

Job summary

PSP Investments is seeking a Senior Developer, Threat Defense and Detection Engineering, to join the Security Operations Centre in Montreal. You will design, implement and maintain detections using KQL for Microsoft Sentinel and Defender XDR, and collaborate with platform teams to ensure telemetry quality and coverage across PSP’s global environment.

The role involves automating incident response, supporting production detections, and guiding analysts with best practices in detection

Qualifications

• Bachelor's degree in a technical field or equivalent experience.
• Minimum of five years hands-on cybersecurity experience in security operations, incident response or detection engineering.
• Proven software engineering practices with Python, PowerShell, Git and CI/CD.
• Advanced know-how of KQL for scalable detection and hunting queries.
• Hands-on experience with Microsoft Sentinel and Defender XDR in an enterprise environment.
• Strong familiarity with MITRE ATT&CK and security tooling (EDR/IDS/SIEM).
• English and French bilingual communication across global teams.

Responsibilities

• Detect and translate threat intel into prioritized, use-case driven detections.
• Design and write scalable KQL detection logic for Microsoft Sentinel and Defender XDR.
• Implement preventive controls and signatures in EDR/XDR and network tools.
• Onboard and tune log sources; ensure telemetry coverage and data quality.
• Test, document and release detections in Azure DevOps with CI/CD.
• Support detections in production; resolve false positives and outages.
• Lead automation for incident response and vulnerability tracking.
• Provide guidance and standard patterns across PSP’s security engineering team.

Skills

Python

PowerShell

Git

CI/CD

KQL

Microsoft Sentinel

Defender XDR

CrowdStrike Falcon

MITRE ATT&CK

Bilingual EN/FR

Education

Bachelor's degree in a technical field

Tools

Azure DevOps

Microsoft Sentinel

CrowdStrike Falcon

KQL

Job description

ABOUT US

We’re one of Canada’s largest pension investors, with CAD$320.6 billion of net assets as of March 31, 2026.

We invest funds for thepension plans of thefederalpublicservice, the Canadian Forces, the Royal Canadian Mounted Police andthe ReserveForce. Headquartered in Ottawa, PSP Investments has its principal business office in Montréal and offices in New York, London and Hong Kong.

Capturing and leading complex global investments requires us to work as one to seize valuable opportunities, in close collaboration with some of the world’s top companies. At PSP Investments, you’ll join a team of motivated and engaged professionals, dedicated to propelling our organization further than ever before.

ABOUT THE TEAM

The Security Operations Centre (SOC) is part of PSP’s Information Security team and is accountable for detecting, investigating and containing cyber threats across PSP’s global environment, from the corporate perimeter through to cloud workloads, identities and the investment platforms they support. The SOC runs a hybrid model: an in-house team of specialists based in Montreal, supported by a managed security service provider delivering round-the-clock monitoring.

The SOC delivers five connected services: threat defense and detection engineering, threat hunting, cyber threat intelligence, incident response and forensics, and continuous testing and teaming. Threat Defense implements the controls that detect and prevent threat actor activity targeting PSP, turning the recommendations of intelligence, hunting and testing into use cases running in production. Reporting to the Senior Manager, Security Operations Centre, you will join Threat Defense and work daily with hunters, responders, platform teams and our managed security service provider, on a stack built around Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike Falcon and Azure DevOps.

ABOUT YOUR ROLE

As a Senior Developer, Threat Defense and Detection Engineering , you’ll:

Detect and prevent

• - Turn threat intelligence indicators and the recommendations of hunting, incident response and continuous testing into prioritized, estimated use cases
• - Design and write clean, scalable KQL detection logic for Microsoft Sentinel and Defender XDR, structured around the MITRE ATT&CK framework
• - Implement preventive controls, rules and signatures in EDR/XDR and network security tools, such as custom IOA rules in CrowdStrike Falcon
• - Assess telemetry coverage and data quality with platform teams, and onboard or tune the log sources each use case depends on

Deliver and support in production

• - Test, document and release each detection as code in Azure DevOps (version control, peer review, CI/CD), including true and false positive validation
• - Support detections and automations in production: handle noisy rules and connector or playbook failures, solve complex issues and provide workarounds
• - Bring engineering support to security incidents (emergency detections, containment controls, artifact analysis) and prevent their recurrence
• - Measure results against goals (recommendations implemented, active use cases, ATT&CK coverage, false positives) and steer the detection catalogue

Automate, advise and guide

• - Automate incident response, enrichment and vulnerability tracking (Logic Apps, Python, PowerShell, APIs), including AI-assisted SOC capabilities
• - Assess exposure to zero-day vulnerabilities and misconfigurations, and support mitigation plans and Authorization and Accreditation reviews
• - Define and share detection engineering standards and patterns across PSP, and review content proposed by analysts and our managed security service provider
• - Give partner teams detailed technical recommendations, coordinate mitigation strategies, and guide analysts on KQL and detection engineering

WHAT YOU’LL NEED

• - A bachelor’s degree in a technical field (computer science, IT engineering or similar) or equivalent experience
• - A minimum of five (5) years of hands‑on cybersecurity experience, including security operations, incident response or detection engineering
• - Proven software engineering practice within a formal delivery life cycle: Python and PowerShell, Git, code review and CI/CD (Azure DevOps or equivalent)
• - Advanced command of Kusto Query Language (KQL): designing, optimizing and maintaining detection and hunting queries at scale
• - Hands‑on depth with Microsoft Sentinel (analytics rules, automation rules, playbooks, data connectors, workbooks) in an enterprise environment
• - Strong experience creating and tuning rules, signatures and alerts in SIEM, EDR/XDR and IDS solutions, such as Defender XDR and CrowdStrike Falcon
• - Working command of MITRE ATT&CK, cyber-attack stages and adversary techniques, and of system, network and application vulnerabilities
• - Solid knowledge of modern operating systems (Windows, Linux), TCP/IP and network security technologies, and Azure and hybrid cloud security monitoring
• - Experience with vulnerability scanning and management, and with automating security workflows (SOAR, Logic Apps, REST APIs)
• - Excellent communication skills, adapting messages to technical and non-technical audiences, with rigorous documentation and mentoring habits
• - Certifications such as SC-200, GCIA, GCDA, GCIH, GCED or CISSP; depth in malware analysis or threat hunting; experience applying AI and LLM tooling to security operations; experience in financial services or another regulated industry are considered assets
• - Bilingualism: English and French (frequent interactions in English with PSP employees based in our offices in Hong Kong, London and New York, and interactions in French with employees in our local offices in Montreal and Ottawa)

We offer a tailored employee experience and competitive total rewards and benefits package* designed to attract and retain global diverse talent, reward performance, and reinforce business strategies and priorities. Beyond salary and incentive pay eligibility, you have access to:

• - Investment in career development
• - Comprehensive group insurance plans
• - Competitive pension plans
• - Unlimited access to virtual healthcare services and wellness programs
• - Gender-inclusive paid family leave policy : up to 26 weeks for primary caregivers, 5 weeks for secondary caregivers
• - A personalized family-building support , from pre-pregnancy to menopause, with available financial assistance
• - Vacation days available on day one with additional days on milestone service anniversaries, and summer Friday afternoons off
• - A hybrid work model that includes four in-office days, Monday through Thursday
• - The opportunity to work temporarily from another location in accordance with the applicable policy

*Benefits package may vary based on your employee type.

At PSP Investments, we aim to provide a workplace where everyone feels valued, safe, respected and empowered to grow. As part of this leadership commitment, we strongly encourage applications from all qualified applicants and strive to offer an inclusive and accessible candidate experience. If you require any accommodation for any part of the recruitment process, please let us know.

Visit us on www.investpsp.com/en/

Follow us on LinkedIn

#LI-AO1