Senior Developer, Threat Defense and Detection Engineering

ABOUT US

We’re one of Canada’s largest pension investors, with CAD$320.6 billion of net assets as of March 31, 2026.

We invest funds for the pension plans of the federal public service, the Canadian Forces, the Royal Canadian Mounted Police and the Reserve Force. Headquartered in Ottawa, PSP Investments has its principal business office in Montréal and offices in New York, London and Hong Kong.

Capturing and leading complex global investments requires us to work as one to seize valuable opportunities, in close collaboration with some of the world’s top companies. At PSP Investments, you’ll join a team of motivated and engaged professionals, dedicated to propelling our organization further than ever before.

ABOUT THE TEAM

The Security Operations Centre (SOC) is part of PSP’s Information Security team and is accountable for detecting, investigating and containing cyber threats across PSP’s global environment, from the corporate perimeter through to cloud workloads, identities and the investment platforms they support. The SOC runs a hybrid model: an in-house team of specialists based in Montreal, supported by a managed security service provider delivering round-the-clock monitoring.

The SOC delivers five connected services: threat defense and detection engineering, threat hunting, cyber threat intelligence, incident response and forensics, and continuous testing and teaming. Threat Defense implements the controls that detect and prevent threat actor activity targeting PSP, turning the recommendations of intelligence, hunting and testing into use cases running in production. Reporting to the Senior Manager, Security Operations Centre, you will join Threat Defense and work daily with hunters, responders, platform teams and our managed security service provider, on a stack built around Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike Falcon and Azure DevOps.

ABOUT YOUR ROLE

As a Senior Developer, Threat Defense and Detection Engineering , you’ll:

Detect and prevent

- Turn threat intelligence indicators and the recommendations of hunting, incident response and continuous testing into prioritized, estimated use cases
- Design and write clean, scalable KQL detection logic for Microsoft Sentinel and Defender XDR, structured around the MITRE ATT&CK framework
- Implement preventive controls, rules and signatures in EDR/XDR and network security tools, such as custom IOA rules in CrowdStrike Falcon
- Assess telemetry coverage and data quality with platform teams, and onboard or tune the log sources each use case depends on

Deliver and support in production

- Test, document and release each detection as code in Azure DevOps (version control, peer review, CI/CD), including true and false positive validation
- Support detections and automations in production: handle noisy rules and connector or playbook failures, solve complex issues and provide workarounds
- Bring engineering support to security incidents (emergency detections, containment controls, artifact analysis) and prevent their recurrence
- Measure results against goals (recommendations implemented, active use cases, ATT&CK coverage, false positives) and steer the detection catalogue

Automate, advise and guide

- Automate incident response, enrichment and vulnerability tracking (Logic Apps, Python, PowerShell, APIs), including AI-assisted SOC capabilities
- Assess exposure to zero-day vulnerabilities and misconfigurations, and support mitigation plans and Authorization and Accreditation reviews
- Define and share detection engineering standards and patterns across PSP, and review content proposed by analysts and our managed security service provider
- Give partner teams detailed technical recommendations, coordinate mitigation strategies, and guide analysts on KQL and detection engineering

WHAT YOU’LL NEED

- A bachelor’s degree in a technical field (computer science, IT engineering or similar) or equivalent experience
- A minimum of five (5) years of hands-on cybersecurity experience, including security operations, incident response or detection engineering
- Proven software engineering practice within a formal delivery life cycle: Python and PowerShell, Git, code review and CI/CD (Azure DevOps or equivalent)
- Advanced command of Kusto Query Language (KQL): designing, optimizing and maintaining detection and hunting queries at scale
- Hands-on depth with Microsoft Sentinel (analytics rules, automation rules, playbooks, data connectors, workbooks) in an enterprise environment
- Strong experience creating and tuning rules, signatures and alerts in SIEM, EDR/XDR and IDS solutions, such as Defender XDR and CrowdStrike Falcon
- Working command of MITRE ATT&CK, cyber-attack stages and adversary techniques, and of system, network and application vulnerabilities
- Solid knowledge of modern operating systems (Windows, Linux), TCP/IP and network security technologies, and Azure and hybrid cloud security monitoring
- Experience with vulnerability scanning and management, and with automating security workflows (SOAR, Logic Apps, REST APIs)
- Excellent communication skills, adapting messages to technical and non-technical audiences, with rigorous documentation and mentoring habits
- Certifications such as SC-200, GCIA, GCDA, GCIH, GCED or CISSP; depth in malware analysis or threat hunting; experience applying AI and LLM tooling to security operations; experience in financial services or another regulated industry are considered assets
- Bilingualism: English and French (frequent interactions in English with PSP employees based in our offices in Hong Kong, London and New York, and interactions in French with employees in our local offices in Montreal and Ottawa)

We offer a tailored employee experience and competitive total rewards and benefits package* designed to attract and retain global diverse talent, reward performance, and reinforce business strategies and priorities. Beyond salary and incentive pay eligibility, you have access to:

- Investment in career development
- Comprehensive group insurance plans
- Competitive pension plans
- Unlimited access to virtual healthcare services and wellness programs
- Gender-inclusive paid family leave policy : up to 26 weeks for primary caregivers, 5 weeks for secondary caregivers
- A personalized family-building support , from pre-pregnancy to menopause, with available financial assistance
- Vacation days available on day one with additional days on milestone service anniversaries, and summer Friday afternoons off
- A hybrid work model that includes four in-office days, Monday through Thursday
- The opportunity to work temporarily from another location in accordance with the applicable policy

*Benefits package may vary based on your employee type.

At PSP Investments, we aim to provide a workplace where everyone feels valued, safe, respected and empowered to grow. As part of this leadership commitment, we strongly encourage applications from all qualified applicants and strive to offer an inclusive and accessible candidate experience. If you require any accommodation for any part of the recruitment process, please let us know.

Visit us on www.investpsp.com/en/

Follow us on LinkedIn

#LI-AO1