CyberClan provides enterprise security, and human response to small and midsize enterprises and channel partners through comprehensive risk assessment services, 24/7/365 managed detection and response services, and lightning-fast breach response. Formerly known as Network Test Labs established in Canada and specializing in vulnerability assessments and penetration testing in the gaming industry, CyberClan has grown from three employees in 2006 in one market to over 75 employees with clients in nine countries and offices in the Australia, Canada, United Kingdom, and United States as a leading Managed Services Provider.

Our mission is to make the online world a safer and more secure place by delivering sophisticated cybersecurity solutions in a highly personalized — and human — way.

CyberClan is hiring a Senior Detection Engineer responsible for designing, implementing, and optimizing security detections, monitoring platforms, and security technologies across customer environments. This role involves creating detection rules, analyzing security logs, investigating alerts, and collaborating with response teams when threats are confirmed. The position requires strong analytical skills, programming knowledge, familiarity with security tools, and staying current with emerging cyber threats.

The ideal candidate fosters innovation, ensures constant readiness through training and tooling, and plays a critical role in post-breach remediation, client communication, and maintaining organizational resilience in a 24x7 environment.

The successful candidate will work closely with the SOC Manager and the Detection Engineering Lead. The ideal candidate will have an energetic, can-do attitude and be comfortable working in a metrics-driven environment, delivering results and supporting team members.

Key Responsibilities

Detection Development

Detailed Use Case Documentation

- Standardized use case template creation
- Comprehensive use case description
- Specific detection objectives
- Expected detection outcomes

Threat Modeling

- Map potential attack scenarios
- Define detection logic for each scenario
- Create detailed attack path simulations

Detection Technique Selection

Choose appropriate detection methods

- Signature-based detection
- Anomaly-based detection
- Behavioral detection
- Machine learning-based detection

Detection rule creation

- MITRE ATT&CK; based development
- Effectiveness validation and testing




- Continuous detection refinement
- Collaborate with SOC personnel to improve detection effectiveness

Advanced techniques

- Leverage vendor-provided behavioral analytics, UEBA, threat intelligence, and AI-driven detection capabilities. Identify opportunities to reduce manual effort through process automation

Platform Engineering

Tool architecture

- SIEM/XDR optimization
- Integration development
- Detection processautomation
- Map detections to ATT&CK; techniques, tactics, and procedures

Infrastructure management

- Performance monitoring
- Solution scalability
- Resilient architecture implementation
- Supporting the overall health of SOC, including contribution to strategy and helping with escalations/projects
- Deploy, configure, and onboard EDR, XDR, SIEM, and email security technologies for customer environments.
- Design and maintain log ingestion, normalization, parsing, enrichment, and correlation workflows.

Validation and Tuning

Quality processes

- False positivereduction
- Effectiveness testing
- Detection fine-tuning

Precision management

- Performance metrics
- Detection rate analysis
- Continuous improvement
- Other duties as assigned.

Qualifications:

Required Skills/Experience

Technical Skills

- Experience administering and engineering one or more enterprise SIEM platforms.
- Proficiency in scripting/programming languages (Python, PowerShell)
- Knowledge of log analysis and correlation techniques
- Experience with threat detection methodologies and frameworks (MITRE ATT&CK;)
- Understanding of network protocols and traffic analysis
- Familiarity with endpoint detection tools and technologies

Security Knowledge

- Strong foundation in cybersecurity principles and practices
- Experience writing detection rules and alert logic
- Understanding of common attack vectors and techniques
- Hands-on experience deploying and supporting EDR/XDR platforms.
- Strong understanding of endpoint security controls and telemetry.




- Familiarity with email security technologies and attack techniques.
- Understanding of identity security, cloud security, and authentication technologies.

Operational Experience

- 3-5 years in security operations or engineering roles
- Experience responding to and investigating security incidents
- Demonstrated ability to improve detection capabilities

Soft Skills

- Analytical thinking and problem-solving abilities
- Strong communication skills for explaining technical findings
- Ability to work under pressure during security incidents
- Collaboration skills for cross-team security initiatives

Requirements/Must Haves

- MS Azure, MS Sentinel and Defender experience are must-haves, as are CrowdStrike, Trend VisionOne, and Sentinel One.

Preferred Requirements

- SANS GIAC Certified Detection Engineer (GCDA)
- SANS GIAC Continuous Monitoring (GMON)
- GIAC Certified Intrusion Analyst (GCIA)
- Microsoft Certified: Cybersecurity Architect Expert (SC-100)
- Cloud and AI Security Engineer Associate (SC-500)

Nice to Have

Bilingual: Ability to communicate in English and French

Cyberclan is committed to equal pay for equal work in its compensation practices. The base salary range for this position in Canada is $100,000 - $110,000 CAD per year. A candidate’s salary is determined by various factors including, but not limited to, relevant work experience, skills, certifications and location.

This is Canadian-based employment, and it is expected that all employees maintain legal entitlement to work in Canada. Applicants selected to move forward in the hiring process are subject to background checks, including but not limited to criminal record, credit, and/or reference checks.

Job Type

Full-Time

Location

100% Telecommuting

Candidate must have legal authorization to work in Canada

Benefits

- Paid Time Off
- Annual Paid Wellness Leave
- Paid Day Off to Celebrate Your Birthday
- Health Benefits
- RRSP-Matching
- Telecom reimbursement
- Remote working environment
- High performing and supportive team

% of Travel Required

Ability to travel up to 10%

Physical Requirements

Prolonged periods of sitting at a desk and working on a computer.

CyberClan is an equal chance employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran, or disability status.

📌 Detection Engineer (Canada)
🏢 Cyberclan
📍 Canada