Cyber Detection Engineer: Hybrid | SIEM/SOAR

lululemon; Ontario (CA); Hybrid; USD 80,000 - 105,000; Full time

Benefits offered by this job

Extended health and dental benefits

Paid time off

Generous employee discount

Fitness & yoga classes

Parenthood top-up

Career development & mentoring

Job summary

lululemon is seeking a Cyber Detection & Automation Engineer to design, develop, and maintain high-fidelity threat detection and automation across SOC tools. You will collaborate with SOC analysts, threat intel, and incident responders to ensure proactive detection of malicious activity and efficient response in a hybrid cloud environment.

Responsibilities include building SIEM/EDR detections, tuning alerts, testing content, and creating runbooks.

Qualifications

• Bachelor's degree in cybersecurity, computer science, information technology, or related field.
• 5+ years in cybersecurity, with 3+ years in detection and automation engineering.
• Proficiency in writing detection logic using KQL, SPL or other relevant query languages.
• Experience with query languages such as KQL, SPL and scripting languages (Bash, PowerShell, Python)
• Proficient in developing automations using SOAR platforms, specifically Microsoft Sentinel/Logic Apps
• Understanding of SOC operations, incident response workflows, and threat detection techniques.
• Experience with RESTful APIs and integration of third‑party tools.
• Experience in a cloud‑first or hybrid cloud environment (preferably AWS and Azure).
• Strong knowledge of incident response methodologies, including NIST 800‑61.
• Strong knowledge of MITRE ATT&CK framework, mapping attacker behaviors to telemetry.
• Familiarity with version control (Git), CI/CD pipelines, and infrastructure as code concepts.
• Experience in using security orchestration, automation, and response tools.

Responsibilities

• Design, implement and automate high-fidelity detection rules using SIEM, EDR, and other telemetry sources.
• Monitor and tune alerts to reduce false positives and improve signal-to-noise ratio.
• Regularly test and validate detection content for effectiveness and accuracy.
• Create documentation and knowledge transfer materials for detections and processes.
• Improve detection coverage, accuracy, and resilience through gap analysis.
• Design and develop security automations workflows using SOAR, primarily with Microsoft Sentinel/Logic Apps.
• Build and maintain integrations with SIEM, EDR, Threat Intel feeds, ticketing systems and SOC tools.
• Automate repetitive SOC tasks like alert triage, enrichment, IOC lookups, and ticket creation.
• Develop dashboards or utilities for SOC metrics visibility.
• Collaborate with SOC analysts & threat intelligence to stay ahead of attacker tactics (MITRE ATT&CK).
• Create and update runbooks and playbooks for detection rules and attacker TTPs.
• Prepare and present detailed reports on detection/automation activities to senior management.

Skills

KQL

SPL

PowerShell

Python

SOAR

MITRE ATT&CK

Incident response

Communicate clearly

Education

Bachelor's degree in cybersecurity or related field

Tools

Microsoft Sentinel

Logic Apps

EDR/SIEM tooling

RESTful APIs

Job description

lululemon is seeking a Cyber Detection & Automation Engineer to design, develop, and maintain high-fidelity threat detection and automation across SOC tools. You will collaborate with SOC analysts, threat intel, and incident responders to ensure proactive detection of malicious activity and efficient response in a hybrid cloud environment.

Responsibilities include building SIEM/EDR detections, tuning alerts, testing content, and creating runbooks.