We’re one of Canada’s largest pension investors, with CAD$320.6 billion of net assets as of March 31, 2026. We invest funds for thepension plans of thefederalpublicservice, the Canadian Forces, the Royal Canadian Mounted Police andthe ReserveForce. Headquartered in Ottawa, PSP Investments has its principal business office in Montréal and offices in New York, London and Hong Kong. The Security Operations Centre (SOC) is part of PSP’s Information Security team and is accountable for detecting, investigating and containing cyber threats across PSP’s global environment, from the corporate perimeter through to cloud workloads, identities and the investment platforms they support. The SOC runs a hybrid model: an in-house team of specialists based in Montreal, supported by a managed security service provider delivering round-the-clock monitoring. The SOC delivers five connected services: threat defense and detection engineering, threat hunting, cyber threat intelligence, incident response and forensics, and continuous testing and teaming. Threat Defense implements the controls that detect and prevent threat actor activity targeting PSP, turning the recommendations of intelligence, hunting and testing into use cases running in production. Reporting to the Senior Manager, Security Operations Centre, you will join Threat Defense and work daily with hunters, responders, platform teams and our managed security service provider, on a stack built around Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike Falcon and Azure DevOps. As a Senior Developer, Threat Defense and Detection Engineering , you’ll: Turn threat intelligence indicators and the recommendations of hunting, incident response and continuous testing into prioritized, estimated use cases
- Design and write clean,



scalable KQL detection logic for Microsoft Sentinel and Defender XDR, structured around the MITRE ATT&CK; framework
- Implement preventive controls, rules and signatures in EDR/XDR and network security tools, such as custom IOA rules in CrowdStrike Falcon
- Assess telemetry coverage and data quality with platform teams, and onboard or tune the log sources each use case depends on Deliver and support in production
- Test, document and release each detection as code in Azure DevOps (version control, peer review, CI/CD), including true and false positive validation
- Support detections and automations in production: handle noisy rules and connector or playbook failures, solve complex issues and provide workarounds
- Bring engineering support to security incidents (emergency detections, containment controls, artifact analysis) and prevent their recurrence
- Automate incident response, enrichment and vulnerability tracking (Logic Apps, Python, PowerShell, APIs), including AI-assisted SOC capabilities
- Assess exposure to zero-day vulnerabilities and misconfigurations, and support mitigation plans and Authorization and Accreditation reviews
- Define and share detection engineering standards and patterns across PSP, and review content proposed by analysts and our managed security service provider
- Give partner teams detailed technical recommendations, coordinate mitigation strategies,



and guide analysts on KQL and detection engineering A bachelor’s degree in a technical field (computer science, IT engineering or similar) or equivalent experience
- A minimum of five (5) years of hands‑on cybersecurity experience, including security operations, incident response or detection engineering
- Proven software engineering practice within a formal delivery life cycle: Python and PowerShell, Git, code review and CI/CD (Azure DevOps or equivalent)
- Advanced command of Kusto Query Language (KQL): designing, optimizing and maintaining detection and hunting queries at scale
- Hands‑on depth with Microsoft Sentinel (analytics rules, automation rules, playbooks, data connectors, workbooks) in an enterprise workplace
- Working command of MITRE ATT&CK;, cyber-attack stages and adversary techniques, and of system, network and application vulnerabilities
- Solid knowledge of modern operating systems (Windows, Linux), TCP/IP and network security technologies, and Azure and hybrid cloud security monitoring
- Excellent communication skills, adapting messages to technical and non-technical audiences, with rigorous documentation and mentoring habits
- depth in malware analysis or threat hunting; experience applying AI and LLM tooling to security operations; experience in financial services or another regulated industry are considered assets
- English and French (frequent interactions in English with PSP employees based in our offices in Hong Kong, London and New York, and interactions in French with employees in our local offices in Montreal and Ottawa)

We offer
a tailored employee experience and competitive total rewards and benefits package
* designed to attract and retain global diverse talent, reward performance, and reinforce business stra

📌 Senior Developer, Threat Defense and Detection Engineering (Canada)
🏢 PSP Investments
📍 Canada