Build incident response automation at Wealthsimple using SIEM, SOAR, and AI coding tools within a hybrid Detection & Response team. Investigate real security incidents while developing repeatable workflows for scale.

As an Incident Response Developer, you will work with senior responders and the Manager of Detection & Response. The work combines investigations, automation, playbook development, and incident metrics. You will also collaborate with Engineering, Security Engineering, and detection engineering teams to strengthen response capabilities. This early-career role provides hands-on exposure to incident response and mentorship while supporting sensitive investigations with HR, Fraud, and Privacy.

Key Responsibilities:

- Build playbooks and automate manual incident response steps
- Own triage, evidence collection, analysis, containment,



and documentation
- Coordinate low- and medium-severity incidents as Incident Commander
- Develop repeatable workflows from intake through closure
- Refine SIEM, SOAR, and detection capabilities

Requirements:

- Three or more years of cybersecurity experience
- One to two or more years owning incident investigations
- Experience writing SIEM queries and tuning alerts
- Proficiency with Claude Code, Cursor, ChatGPT, or similar tools
- Working knowledge of AWS, GCP, or Azure investigations

Apply incident response, SIEM expertise, cloud investigation, and automation skills to help Wealthsimple scale security operations.

📌 Incident Response Developer Automation (Toronto)
🏢 Wealthsimple
📍 Toronto