Senior Developer, Threat Defense and Detection Engineering

PSP’s Private Debt & Credit Investment (PDCI) group; Montreal; Híbrido; CAD 120.000 - 160.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Hybrid work model

Comprehensive benefits

Pension plans

Wellness programs

Day-one vacation entitlement

Descripción de la vacante

PSP Investments in Montreal is seeking a Senior Developer focused on Threat Defense and Detection Engineering to join the SOC. You will design and implement scalable detection logic, onboard telemetry, and deliver detections in production while working with Azure DevOps and security tooling.

Ideal candidates bring five+ years of cybersecurity hands-on experience, strong Python/PowerShell scripting, and expertise with Microsoft Sentinel, Defender XDR and CrowdStrike Falcon within a hybrid

Formación

• Five years of hands-on cybersecurity experience including security operations, incident response or detection engineering.
• Proficient in Python and PowerShell, Git, and CI/CD workflows.
• Advanced knowledge of Kusto Query Language (KQL) and Microsoft Sentinel.
• Familiarity with MITRE ATT&CK framework and cloud security monitoring.

Responsabilidades

• Design and write scalable KQL detection logic for Sentinel and Defender XDR.
• Implement preventive controls, rules and signatures in SIEM/EDR tools.
• Onboard and tune log sources for detection use cases.
• Deliver and support detections in production and release as code in Azure DevOps.
• Collaborate with platform teams to ensure telemetry coverage and data quality.
• Guide analysts, coordinate mitigation strategies, and support incident response.

Conocimientos

Cybersecurity experience

Python

PowerShell

Git

CI/CD

KQL

Microsoft Sentinel

Defender XDR

CrowdStrike Falcon

MITRE ATT&CK

Threat detection

Communication

Bilingual English/French

Educación

Bachelor's degree in technical field

Herramientas

Azure DevOps

CrowdStrike Falcon

Microsoft Sentinel

Defender XDR

Descripción del empleo

ABOUT US

We’re one of Canada’s largest pension investors, with CAD$320.6 billion of net assets as of March 31, 2026. We invest funds for the pension plans of the federal public service, the Canadian Forces, the Royal Canadian Mounted Police and the Reserve Force. Headquartered in Ottawa, PSP Investments has its principal business office in Montréal and offices in New York, London and Hong Kong. Capturing and leading complex global investments requires us to work as one to seize valuable opportunities, in close collaboration with some of the world’s top companies. At PSP Investments, you’ll join a team of motivated and engaged professionals, dedicated to propelling our organization further than ever before.

ABOUT THE TEAM

The Security Operations Centre (SOC) is part of PSP’s Information Security team and is accountable for detecting, investigating and containing cyber threats across PSP’s global environment, from the corporate perimeter through to cloud workloads, identities and the investment platforms they support. The SOC runs a hybrid model: an in‑house team of specialists based in Montreal, supported by a managed security service provider delivering round‑the‑clock monitoring. The SOC delivers five connected services: threat defense and detection engineering, threat hunting, cyber threat intelligence, incident response and forensics, and continuous testing and teaming. Threat Defense implements the controls that detect and prevent threat actor activity targeting PSP, turning the recommendations of intelligence, hunting and testing into use cases running in production. Reporting to the Senior Manager, Security Operations Centre, you will join Threat Defense and work daily with hunters, responders, platform teams and our managed security service provider, on a stack built around Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike Falcon and Azure DevOps.

ABOUT YOUR ROLE

As a Senior Developer, Threat Defense and Detection Engineering, you’ll:

• Detect and prevent Turn threat intelligence indicators and the recommendations of hunting, incident response and continuous testing into prioritized, estimated use cases
• Design and write clean, scalable KQL detection logic for Microsoft Sentinel and Defender XDR, structured around the MITRE ATT&CK framework
• Implement preventive controls, rules and signatures in EDR/XDR and network security tools, such as custom IOA rules in CrowdStrike Falcon
• Assess telemetry coverage and data quality with platform teams, and onboard or tune the log sources each use case depends on
• Deliver and support in production
• Test, document and release each detection as code in Azure DevOps (version control, peer review, CI/CD), including true and false positive validation
• Support detections and automations in production: handle noisy rules and connector or playbook failures, solve complex issues and provide workarounds
• Bring engineering support to security incidents (emergency detections, containment controls, artifact analysis) and prevent their recurrence
• Measure results against goals (recommendations implemented, active use cases, ATT&CK coverage, false positives) and steer the detection catalogue
• Automate, advise and guide
• Automate incident response, enrichment and vulnerability tracking (Logic Apps, Python, PowerShell, APIs), including AI-assisted SOC capabilities
• Assess exposure to zero-day vulnerabilities and misconfigurations, and support mitigation plans and Authorization and Accreditation reviews
• Define and share detection engineering standards and patterns across PSP, and review content proposed by analysts and our managed security service provider
• Give partner teams detailed technical recommendations, coordinate mitigation strategies, and guide analysts on KQL and detection engineering

WHAT YOU’LL NEED

• A bachelor’s degree in a technical field (computer science, IT engineering or similar) or equivalent experience
• A minimum of five (5) years of hands‑on cybersecurity experience, including security operations, incident response or detection engineering
• Proven software engineering practice within a formal delivery life cycle: Python and PowerShell, Git, code review and CI/CD (Azure DevOps or equivalent)
• Advanced command of Kusto Query Language (KQL): designing, optimizing and maintaining detection and hunting queries at scale
• Hands‑on depth with Microsoft Sentinel (analytics rules, automation rules, playbooks, data connectors, workbooks) in an enterprise environment
• Strong experience creating and tuning rules, signatures and alerts in SIEM, EDR/XDR and IDS solutions, such as Defender XDR and CrowdStrike Falcon
• Working command of MITRE ATT&CK, cyber‑attack stages and adversary techniques, and of system, network and application vulnerabilities
• Solid knowledge of modern operating systems (Windows, Linux), TCP/IP and network security technologies, and Azure and hybrid cloud security monitoring
• Experience with vulnerability scanning and management, and with automating security workflows (SOAR, Logic Apps, REST APIs)
• Excellent communication skills, adapting messages to technical and non‑technical audiences, with rigorous documentation and mentoring habits
• Certifications such as SC-200, GCIA, GCDA, GCIH, GCED or CISSP; depth in malware analysis or threat hunting; experience applying AI and LLM tooling to security operations; experience in financial services or another regulated industry are considered assets
• Bilingualism: English and French (frequent interactions in English with PSP employees based in our offices in Hong Kong, London and New York, and interactions in French with employees in our local offices in Montreal and Ottawa)

We offer a tailored employee experience and competitive total rewards and benefits package* designed to attract and retain global diverse talent, reward performance, and reinforce business strategies and priorities. Beyond salary and incentive pay eligibility, you have access to: Investment in career development Comprehensive group insurance plans Competitive pension plans Unlimited access to virtual healthcare services and wellness programs Gender‑inclusive paid family leave policy: up to 26 weeks for primary caregivers, 5 weeks for secondary caregivers A personalized family‑building support, from pre‑pregnancy to menopause, with available financial assistance Vacation days available on day one with additional days on milestone service anniversaries, and summer Friday afternoons off A hybrid work model that includes four in‑office days, Monday through Thursday The opportunity to work temporarily from another location in accordance with the applicable policy *Benefits package may vary based on your employee type. At PSP Investments, we aim to provide a workplace where everyone feels valued, safe, respected and empowered to grow. As part of this leadership commitment, we strongly encourage applications from all qualified applicants and strive to offer an inclusive and accessible candidate experience. If you require any accommodation for any part of the recruitment process, please let us know. Visit us on www.investpsp.com/en/ Follow us on LinkedIn #LI-AO1 We’re one of Canada’s largest pension investment managers, with CAD$320.6 billion of net assets. We invest funds for the pension plans of the federal public service, the Canadian Forces, the Royal Canadian Mounted Police and the Reserve Force. We are committed to fostering an environment where experiences and learning opportunities provide you with the platform to grow. If you are having difficulty applying, you can reach us at [e-mail]