Cyber Defense Engineer

''•Toronto, ON

13h•CA$69,700 - CA$93,000•Hybrid

About The Position

We are seeking a hands-on Cyber Defense Engineer to help evolve our Security Operations capability from a traditional monitoring model to a modern, engineering-driven detection and response function. This role sits within our Cyber Security Operations team and will focus on designing, building, and optimizing cloud-native security capabilities in Microsoft Azure, while working closely with our MDR partner and internal stakeholders. This is an opportunity to build—not just run—security operations, shaping how we detect, respond to, and mitigate threats across a global food enterprise.

Requirements

Hands-on experience with Microsoft Security Stack, including Sentinel (SIEM)
Strong working knowledge of Azure security services: Defender for Cloud, Microsoft Defender XDR, Entra ID (Azure AD)
Proficiency in KQL (Kusto Query Language)
Experience building SOAR playbooks (Logic Apps preferred)
Experience in detection engineering, automation, or security tooling development
Ability to design and build solutions, not just operate tools
Familiarity with scripting (Python, PowerShell, or similar)
Understanding of SOC processes, incident response, and threat detection
Familiarity with frameworks like MITRE ATT&CK, NIST CSF

Nice To Haves

Experience working with or alongside an MDR/SOC provider is an asset

Responsibilities

Design, develop, and tune detection use cases in Microsoft Sentinel and Defender
Build and maintain analytics rules, KQL queries, and alerting logic
Improve signal-to-noise ratio by tuning detections and reducing false positives
Develop automation playbooks (Logic Apps / SOAR) to streamline response actions
Integrate security tooling across Azure, M365, and enterprise platforms
Enable end-to-end detection-to-response workflows
Implement and enhance Azure-native security controls (Defender for Cloud, Entra ID, etc.)
Monitor and secure cloud workloads, identities, and data flows
Partner with cloud/platform teams to embed security-by-design
Translate threat intelligence into actionable detections
Map detections to frameworks such as MITRE ATT&CK
Continuously improve coverage against priority threat scenarios (e.g., identity compromise, ransomware)
Work closely with our MDR partner to improve detection quality, define escalation paths, and drive continuous improvement
Act as a technical bridge between internal teams and external providers