Senior Security Engineer: Detection & Response Architect

EvenUp; Toronto; Hybrid; CAD 150,000 - 210,000; Full time

Benefits offered by this job

Medical, dental, and vision

Life and critical illness insurance

Flexible PTO and disability

Holidays by province

Home office stipend

RRSP/401(k) plans

Paid parental leave

In-person meetups

Hubs in Toronto

Job summary

EvenUp in Toronto is seeking a hands-on Senior Security Engineer to build our detection and response program across telemetry pipelines, SIEM, and incident response. This role shapes security at a fast-growing vertical SaaS company and collaborates with engineers to embed security in product data flows.

You will lead SIEM evaluation, write detections, define telemetry, and own post-incident reviews, with hybrid work in Toronto three days a week and opportunities to influence security

Qualifications

• 5+ years in security operations, detection engineering, or incident response, including startup or high-growth tech experience.
• Hands-on SIEM implementation and customization experience.
• Strong detection engineering skills: Python/SQL/dsl, version control, and quality metrics.
• Real incident response leadership with playbooks and retros.
• Experience with cloud-native telemetry (AWS/GCP/Azure) and security visibility.
• Programming/automation skills; comfortable building integrations for security workflows.
• Experience instrumenting applications for security visibility and telemetry.
• Familiarity with AI/LLM security considerations is a plus.
• Experience with MDR/MSSP providers and evaluating security services.
• Builder mentality: engineer the alert away, not just triage.
• Security certifications (GIAC/GCIA/GCIH, CISSP, etc.) are a plus.

Responsibilities

• Build Our Detection Platform: Lead SIEM evaluation and implementation, design log ingestion and retention trade-offs.
• Engineer High-Signal Detections: Develop detections across cloud, identity, endpoint, SaaS, and application telemetry.
• Define the Telemetry Contract: Specify logs with Engineering/DevOps to detect key risks.
• Lead Incident Response: Create IR playbooks, runbooks, and post-incident reviews.
• Detect Data Exposure: Identify sensitive data movement across apps, endpoints, and SaaS.
• Manage 24/7 Coverage: Direct managed detection partners and escalation procedures.

Skills

SIEM engineering

Detection engineering

Python

Incident response

Cloud telemetry

Automation

Cross-functional collaboration

Security certifications

Tools

AWS/GCP/Azure

Audit logs

MDR/MSSP partnerships

Job description

EvenUp in Toronto is seeking a hands-on Senior Security Engineer to build our detection and response program across telemetry pipelines, SIEM, and incident response. This role shapes security at a fast-growing vertical SaaS company and collaborates with engineers to embed security in product data flows.

You will lead SIEM evaluation, write detections, define telemetry, and own post-incident reviews, with hybrid work in Toronto three days a week and opportunities to influence security