Threat Operations & Detection Specialist Our Firm leads the way in a rapidly changing legal marketplace. We challenge the status quo and deliver consistent results as well as uncompromising quality and value to our clients. Our global presence is renowned as a firm with over 21,000 individuals in more than 200 offices serving clients across 80+ countries. Dentons Canada is committed to its people and communities. Canada’s Top Employers for Young People (2026), and Canada’s Best Diversity Employers (2026). Dentons Canada LLP is currently recruiting for a Threat Operations & Detection Specialist who will be responsible for continuously improving threat detection, response readiness, and cyber resilience across the Canada technology environment. The candidate will govern the Managed Detection and Response (MDR) service, lead detection engineering, support incident response, perform threat hunting, and act as a technical escalation and backup for operational security requests when required. Govern the MDR service to ensure high-quality monitoring, escalation, investigation support, reporting, and continuous improvement. Develop, tune, and maintain high-fidelity detection use cases across Microsoft Sentinel, Defender XDR, identity, endpoint, cloud, email, and network telemetry. Improve detection coverage using MITRE ATT&CK;, threat intelligence, incident learnings, audit findings, and identified control gaps. Work with the MDR provider to reduce false positives, validate alerts, improve escalation quality, and ensure meaningful visibility into priority threats. Threat Hunting, Incident Response & Technical Investigation Conduct proactive threat hunting using SIEM, EDR/XDR, identity, cloud, email, network, and other relevant telemetry sources. Act as a technical responder for phishing, malware,



account compromise, endpoint compromise, insider threat, suspicious access, and cloud security events. Support containment, eradication, recovery, forensic evidence collection, incident timelines, and post-incident reviews. Threat Intelligence, Emerging Threats & Continuous Improvement Monitor emerging threats relevant to professional services and legal environments, including identity compromise, ransomware, supply chain attacks, cloud abuse, API abuse, data theft, and AI-enabled phishing. Convert threat intelligence into practical detection use cases, hunting hypotheses, playbook improvements, and preventive recommendations. Collaborate with the Information Security Design Specialist and Cloud & Vulnerability Specialist to ensure threat intelligence informs architecture, configuration, and exposure reduction priorities. Identify opportunities for SOAR, automation, AI-assisted investigation, and process improvement across detection and response workflows. Support escalated phishing investigations, security mailbox inquiries, high-risk URL or web filtering requests, DLP alerts, exception reviews, and operational security tickets when required. Provide coaching, quality review, and technical guidance to the Security Services function for phishing triage, evidence gathering, ticket enrichment, escalation paths, and operational procedures. Strong knowledge of Microsoft Sentinel, Defender XDR, EDR,



SIEM, identity security, cloud telemetry, email security, and modern detection techniques. Ability to analyze alerts, logs, IOCs, behavioural indicators, and suspicious activity to determine risk and recommend appropriate response actions. Ability to work effectively with MDR providers, infrastructure teams, identity teams, service desk teams, legal/privacy stakeholders, and business users. Solid written and verbal communication skills with the ability to document investigations and explain technical findings clearly. Ability to remain calm under pressure and provide practical, risk-based guidance during security incidents and operational escalations. Post-secondary education in Information Technology, Computer Science, Cybersecurity, or a related discipline, or equivalent practical experience. Hands-on experience with SIEM and XDR/EDR platforms such as Microsoft Sentinel, Microsoft Defender XDR, Splunk, QRadar, CrowdStrike, or similar technologies. Experience investigating phishing, malware, account compromise, endpoint compromise, suspicious authentication, cloud security alerts, and other security events. Experience working with MDR, MSSP, or SOC providers, including alert escalation, service quality review, reporting, or detection improvement. Familiarity with SOAR, automation, threat intelligence platforms, vulnerability intelligence, and security orchestration workflows is an asset. Familiarity with Microsoft security technologies including Defender for Endpoint, Defender for Identity, Defender for Cloud, Defender for Office 365, Entra ID, and Sentinel is preferred. Certifications such as GCIA, GCED, GCIH, GCFA, GNFA, CISSP, CISM, Microsoft Security, or equivalent are p

📌 IT Threat Operations (Calgary)
🏢 Dentons Canada
📍 Calgary