Staff Security Engineer (AI-Driven Detection & Response)

Fullscript; Ottawa; Hybrid; CAD 140,000 - 190,000; Full time

Benefits offered by this job

Benefits plan

DEIB Council

Flexible work location (onsite or home

Lunch and learns

Community events

Carbon-neutral company

Job summary

Fullscript is seeking a Staff Security Engineer to define and drive our defensive threat detection, incident response, and AI-assisted SecOps across cloud, identity, endpoints, and applications.

You will architect modern detection systems, leverage AI/ML to automate SecOps workflows, and establish defensive testing for AI threat vectors, while partnering with Engineering to scale detection and response across our fast-growing, AI-first infrastructure.

Qualifications

• Own enterprise-scale detection engineering and incident response end-to-end.
• Architect AI-augmented SecOps workflows and defensive testing for AI threats.
• Experience in securing cloud environments (AWS) and modern SaaS/identity stacks.
• Hands-on incident response: triage, containment, and postmortem.
• Ability to translate threat telemetry into automated, precise detections.

Responsibilities

• Define and drive multi-quarter direction for detection and response across teams.
• Create and maintain advanced detection logic across SIEM, cloud, identity, endpoint, and AI/ML pipelines.
• Lead defensive testing, purple-teaming, and adversarial validation exercises.
• Collaborate with Platform/Engineering to ensure telemetry for security monitoring.
• Mentor Security Operations team and elevate investigation rigor.

Skills

AI/ML SecOps

Threat detection

Incident response

Detection engineering

SOAR workflows

Cloud security

Python/JavaScript

Telemetry requirements

Communication

Open detection content

Tools

Terraform

SIEM

SOAR platforms

Job description

• We’re looking for a Staff Security Engineer to define and drive Fullscript’s defensive threat detection, incident response, and AI-assisted SecOps capability across our cloud infrastructure, identity, endpoints, and application ecosystems
• This role sits at the technical core of our Security function. You will architect modern detection systems, leverage AI/ML to automate SecOps workflows, and establish defensive testing practices for AI threat vectors
• Partnering with Engineering and Platform teams, you will ensure our detection and response capabilities scale with Fullscript’s fast-growing, AI-first infrastructure
• Set the multi-quarter technical direction for detection and response, and drive it across Security, Platform, and Engineering teams
• Architect, author, and maintain advanced detection logic across SIEM, cloud infrastructure, identity systems, endpoint protection, and AI/ML pipelines
• Establish detection coverage and defensive controls against emerging AI and agentic threat vectors (e.g., prompt injection, tool misuse, and data exfiltration patterns)
• Own the full rule lifecycle, from authoring and testing through tuning and retirement, and measure it against concrete signals: detection coverage, precision (false-positive rate), and time-to-detect
• Create and maintain dashboards and reporting that give leadership visibility into alert volume, response times, and trends over time
• Design and deploy AI-assisted investigation workflows that leverage LLMs and automated agents to accelerate triage, context enrichment, and threat containment
• Build and extend internal security tooling to support identity resolution, cross-source log correlation, and natural-language querying over security telemetry
• Automate the handoff between detection tooling and our ticketing system so investigations move from alert to resolution with minimal manual work
• Lead and support security investigations end-to-end, from initial triage through containment and resolution
• Mentor Security Operations team members and set the standards the team builds against, including rule quality, detection-as-code practices, and investigation rigor
• Partner with relevant teams across the business to investigate and remediate security escalations surfaced from Customer Support, Customer Delivery, and internal teams
• Maintain and improve response playbooks based on lessons learned from real investigations
• Participate in an on-call rotation to respond to security incidents outside business hours
• Threat model new and existing systems, including AI agents and services, to identify what could go wrong, what we would need to see to catch it, and how we would respond
• Lead defensive testing, purple-teaming, and adversarial validation exercises to test alert fidelity and evaluate detection resilience against AI-driven threats
• Partner with Platform and Engineering teams to ensure new AI services and features expose necessary logging and telemetry for effective security monitoring
• Evaluate authorization and access-control changes for security-relevant blast radius, and drive remediation with the engineering teams that own the affected systems
• Operationalize threat intelligence into actionable detections and tracked follow-up work
• Coordinate indicator of compromise (IOC) blocking across endpoint, network, and web layers

Benefits

• Reach your wellness goals with our benefits plan, discount on practitioner-grade supplements, and company-wide health and wellness programs
• Our dedicated DEIB Council ensures we advocate for equality and encourage positive change within ourselves and the community. We value the unique qualities and perspectives of our team
• You choose your own office with our Wherever You Work Well approach. Whether that’s in-person or at home, teams aren’t defined by geography. Output, not location, is our success metric so we also offer a flexible approach to your working hours, vacation, and personal days
• We empower each other to grow with lunch and learns, lean in circles, show-and-tells, and more. Everyone has something to learn and something to teach so we pride ourselves on growing as a team
• We’re not just a company — we’re a community. Team lunches, weekly town halls, birthdays, parties, and clubs are an essential part of our community and culture
• The health of our people relies on the health of our planet. We are certified carbon-neutral, taking our first big step in creating a more sustainable future

The ideal candidate has owned enterprise-scale detection engineering and incident response end-to-end. You are a pragmatic, forward-thinking engineer who excels at designing AI-augmented SOC workflows, conducting targeted AI defensive testing, and converting threat telemetry into automated, high-precision detection and response systemsWorking knowledge of adversary tradecraft (MITRE ATT&CK) and the ability to translate it into practical, tuned detections rather than noisy alertsExperience managing security controls as code (e.g., Terraform), with changes made through peer review rather than manual console changes8+ years of experience in detection engineering, incident response, or security engineering, with demonstrated leadership in shaping organizational security strategyPractical experience incorporating AI tooling into SecOps workflows, along with familiarity with detection strategies for AI-specific threat vectorsHands-on incident response experience: triage, investigation, containment, and postmortem/playbook developmentExperience securing cloud environments (AWS preferred) and modern SaaS/identity stacksStrong scripting/automation skills (Python, JavaScript, or similar) and experience building workflows in a SOAR-style or workflow automation platformProven ability to partner directly with engineering and infrastructure teams to define telemetry and control requirements for systems you don’t ownExcellent written communication. This role regularly turns investigation findings into clear, factual updates for technical and non-technical stakeholders alikeExperience contributing to or building from open detection content, such as Sigma rules or community rule reposExperience collaborating with red/purple-team exercises to validate detection coverageExperience supporting a healthcare, regulated, or otherwise highly sensitive-data environmentRelevant certifications (GCIH, GCFA, GCTI, GCDA, or equivalent practical experience)