BeyondTrust is a place where you can bring your purpose to life through the work that you do, creating a safer world through our cybersecurity SaaS portfolio.You will be surrounded by people who challenge, support, and inspire you to be the best version of yourself.Our products provide remote access and privileged control capabilities that are deployed across thousands of enterprise environments worldwide. Nation-state actors, ransomware operators, and sophisticated threat groups actively target companies like ours—not just to compromise our corporate environment, but to reach the customers who trust our software to protect their most sensitive systems. A compromise of BeyondTrust is a compromise of the privileged access layer inside our customers’ networks.

As a Cyber Defense Engineer on our Cyber Defense Operations team, you will serve as a front-line defender responsible for protecting both BeyondTrust’s enterprise infrastructure and the integrity of the products our customers depend on. This team is building toward an AI-augmented operating model. You will be expected to use AI-driven tools in your daily work and to contribute to how we integrate these capabilities into our detection, triage, and response workflows.

Alert

Triage & MonitoringMonitor and triage security alerts across SIEM, EDR, and CSPM platforms covering both corporate and product environments.Leverage AI-assisted triage and enrichment tools to accelerate analysis and reduce mean time to detect.Participate in or lead incident response engagements from detection through remediation, including evidence collection, forensic analysis, root cause determination, and stakeholder communication.Conduct investigations across SIEM, EDR, CSPM, and cloud-native log sources including identity provider logs,



cloud audit trails, and network flow data—spanning both corporate and product infrastructure.Manage or assist with evidence handling, forensic artifact collection, and chain-of-custody procedures.Produce clear, decision-ready incident summaries and post-incident reports for both technical and leadership audiences.Contribute to the design, implementation, and tuning of detection rules across SIEM and EDR platforms, with a focus on reducing false positives and closing coverage gaps.Translate threat intelligence (CVE advisories, CISA alerts, vendor bulletins, open-source feeds) into actionable detection content, with particular attention to threats targeting privileged access tooling and supply chain attack vectors.Help maintain and evolve detection coverage mapped to MITRE ATT&CK.AI; Integration & AutomationUse AI-driven tools for alert triage, enrichment, and investigation as a standard part of daily operations.Contribute to the evaluation, integration, and optimization of AI and automation capabilities across the team’s workflows.Assist in designing prompts, agent workflows, or LLM-based pipelines that augment analyst capabilities and reduce manual effort.Partner with engineering teams to improve log ingestion, data quality,



and tool integrations.Operational ExcellenceMaintain daily operational notes and shift handoff documentation.Participate in on-call rotation for after-hours incident escalation.Understanding of common attack frameworks (MITRE ATT&CK;), network protocols, and endpoint behavior.Experience with at least one SIEM platform and familiarity with writing search or detection queries.Comfort using AI systems (e.LLM-based assistants, copilots, or AI-driven analysis tools) as part of security workflows.able to document findings clearly and concisely for both technical and non-technical audiences.Scripting and automation skills (Python, PowerShell, or equivalent) applied to security workflows.Experience designing or implementing AI agent architectures, LLM-based automation pipelines, or prompt engineering for security use cases.Experience building or contributing to threat intelligence programs or detection-as-code pipelines.Track record of evaluating and adopting emerging technologies in a production security setting.Diversity. Inclusion. We take care of our employees so they can take care of our customers.

Customers who come from all walks of life just like us. BeyondTrust is the global identity security leader protecting Paths to Privilege™. Our identity-centric approach goes beyond securing privileges and access, empowering organizations with the most effective solution to manage the entire identity attack surface and neutralize threats, whether from external attacks or insiders.BeyondTrust is leading the charge in transforming identity security to prevent breaches and limit the blast radius of attacks, while creating a superior customer experience and operational efficiencies.

We are trusted by 20,000 customers, including 75 of the Fortune 100, and our global ecosystem of partners. #

📌 Country Match Cyber Defense Engineer Remote Canada | Remote United States Information Security (Winnipeg)
🏢 BeyondTrust
📍 Winnipeg