About the team + roleWe are building an elite team, applying frontier technologies to the world’s biggest financial problems. We’re looking for bold thinkers, sharp problem‑solvers, and builders who are wired to make an impact. Robinhood isn’t a place for complacency, it’s where ambitious people do the best work of their careers. We’re a high‑performing, rapid‑moving team with ethics at the center of everything we do. Expectations are high, and so are the rewards. The Security Operations (SecOps) team works to safeguard Robinhood and its customers by identifying, investigating, and responding to security threats. The team monitors production systems, endpoints, and cloud environments, and uses threat intelligence and structured testing to uncover risks before they affect customers. SecOps partners closely with engineering and infrastructure teams to strengthen detection coverage and response readiness. The team’s focus is explicit: reduce risk, improve visibility, and protect customer trust every day! What you’ll doInvestigate security alerts across SIEM, EDR, and cloud security platforms, perform log analysis, and coordinate containment or remediation steps with engineering partners Develop, test, and tune detection rules using query languages to improve signal quality and reduce false positives Correlate data from multiple telemetry sources to identify attack patterns and determine appropriate response actions Monitor emerging threats and update detection logic based on investigation findings and threat intelligence reporting Contribute to automation efforts by building or refining SOAR playbooks and scripts that improve investigation speed and consistency Document incidents and contribute to post‑incident reviews with explicit findings and recommended improvements to detection and response processes What you bring2–4 years of experience in security operations, detection engineering, or incident response Experience analyzing logs and tuning alerts within SIEMs, EDR platforms, and cloud security tools Experience writing detections using query languages (e.G., SQL‑like, KQL, or similar) Familiarity with threat hunting and investigation techniques across cloud and endpoint environments Ability to analyze security telemetry, identify patterns of malicious activity, and recommend practical improvements Clear written and verbal communication skills when documenting incidents and collaborating with technical teams Nice to haveExperience developing and deploying SOAR playbooks to automate detection and response workflows Familiarity with AWS, Okta, Kubernetes, and/or Google Workspace security monitoring tools Experience writing software to support detection and response tooling with a focus on secure, maintainable code Experience in building Agentic workflows, optimizing workflows with Generative AI Base Pay RangeToronto, ON $136,000 - $160,000 CAD Our team is committed to providing an inclusive and welcoming interview experience for all candidates. If you require a specific accommodation during the application or interview process due to a physical or mental condition, please complete this Applicant Accommodation Form to notify our team. The form should only be completed if you need a specific accommodation. Robinhood provides equal opportunity for all applicants, offers reasonable accommodations upon request, and complies with applicable equal employment and privacy laws. Inclusion is built into how we hire and work—welcoming different backgrounds, perspectives, and experiences so everyone can do their best. Please review the policy for your country of application.#J-18808-Ljbffr

📌 Security Engineer, Detection & Response (Toronto) (Winnipeg) - C$136,000 - C$160,000 A Year
🏢 Robinhood
📍 Winnipeg