Senior Security Engineer - Insider Threat
A
AffirmInformation security
Remote Canada; this remote role is open only to candidates residing in Alberta, British Columbia, Manitoba, New Brunswick, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, or Saskatchewan.Full-TimeSenior
Salary153,000 - 213,000 CAD per year
Apply NowOpens the employer's application page
Job Details
- Required Skills
- Python
Requirements
- Bring deep expertise in security engineering, security operations, insider risk, or digital forensics.
- Have a track record of establishing new security capabilities where little existed before.
- Have experience running investigations end to end, including evidence handling, log and endpoint forensics, timeline reconstruction, and written findings for Legal and HR audiences.
- Be able to write and evaluate detection logic against endpoint, identity, cloud, and SaaS telemetry in a SIEM such as Splunk, Elastic, Panther, or Chronicle.
- Have hands-on experience with insider risk tools such as DLP, UEBA, endpoint detection and response, CASB, and access governance.
- Have working knowledge of Python for security tooling and automation.
- Have experience building and maintaining production workflows in automation platforms such as Tines or Torq.
- Have experience building and operating production agentic automations for alert triage and investigation, with human review kept in the loop where appropriate.
- Use discretion and sound judgment when handling sensitive investigations, including privacy, legal, and employee-relations considerations.
- Communicate clearly in writing and verbally and work across Security, Engineering, Legal, HR, Privacy, and Compliance.
- Experience in regulated or financial services environments, including SOC 2, PCI DSS, or GLBA, is a plus.
Responsibilities
- Lead insider threat workstreams from initial design through day-to-day operation.
- Develop investigative standards, playbooks, metrics, and reporting for the program.
- Support insider risk investigations with SIRT, including telemetry and evidence analysis and written findings and risk recommendations.
- Partner with Legal, HR/Employee Relations, Privacy, and Compliance on case handling and escalation criteria.
- Threat-model high-risk data and systems and work with detection engineers to create production detections.
- Own and improve insider risk controls, including data loss prevention, endpoint monitoring, secure browser and contractor access controls, SaaS posture management, and access governance.
- Automate evidence collection, case routing, and reporting using workflow automation platforms and Python.
- Build agentic automations to assist insider risk triage and investigations, and define which decisions require human review.
View Full Description & ApplyYou'll be redirected to the employer's site
