{"id":2651801,"url":"https://alion.io/job/fullscript-staff-security-engineer-ai-driven-detection-response","title":"Staff Security Engineer, AI-Driven Detection & Response","company":{"id":9061,"name":"Fullscript","domain":"fullscript.com","url":"https://alion.io/company/fullscript","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":null},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Ottawa, Canada","Calgary, Canada","Toronto, Canada"],"countries":["CA"],"hiring_countries":["CA"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":80000,"max_usd":148000,"period":"year","method":"role_seniority_country_cell","sample_n":12},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"JavaScript","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Terraform","optional":false}],"status":"live","first_seen_at":"2026-10-15T14:00:19Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-16T01:16:14Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"The Opportunity\nWe're looking for a Staff Security Engineer to define and drive Fullscript's defensive threat detection, incident response, and AI-assisted SecOps capability across our cloud infrastructure, identity, endpoints, and application ecosystems.\nThis role sits at the technical core of our Security function. You will architect modern detection systems, leverage AI/ML to automate SecOps workflows, and establish defensive testing practices for AI threat vectors. Partnering with Engineering and Platform teams, you will ensure our detection and response capabilities scale with Fullscript's fast-growing, AI-first infrastructure.\nThe ideal candidate has owned enterprise-scale detection engineering and incident response end-to-end. You are a pragmatic, forward-thinking engineer who excels at designing AI-augmented SOC workflows, conducting targeted AI defensive testing, and converting threat telemetry into automated, high-precision detection and response systems.\nWhat You'll Do\nDetection Engineering & Defensive Strategy\nSet the multi-quarter technical direction for detection and response, and drive it across Security, Platform, and Engineering teams.\n\nArchitect, author, and maintain advanced detection logic across SIEM, cloud infrastructure, identity systems, endpoint protection, and AI/ML pipelines.\n\nEstablish detection coverage and defensive controls against emerging AI and agentic threat vectors (e.g., prompt injection, tool misuse, and data exfiltration patterns).\n\nOwn the full rule lifecycle, from authoring and testing through tuning and retirement, and measure it against concrete signals: detection coverage, precision (false-positive rate), and time-to-detect.\n\nCreate and maintain dashboards and reporting that give leadership visibility into alert volume, response times, and trends over time.\n\nAI-Augmented Security Operations & Automation\nDesign and deploy AI-assisted investigation workflows that leverage LLMs and automated agents to accelerate triage, context enrichment, and threat containment.\n\nBuild and extend internal security tooling to support identity resolution, cross-source log correlation, and natural-language querying over security telemetry.\n\nAutomate the handoff between detection tooling and our ticketing system so investigations move from alert to resolution with minimal manual work.\n\nIncident Response & Investigations\nLead and support security investigations end-to-end, from initial triage through containment and resolution.\n\nMentor Security Operations team members and set the standards the team builds against, including rule quality, detection-as-code practices, and investigation rigor.\n\nPartner with relevant teams across the business to investigate and remediate security escalations surfaced from Customer Support, Customer Delivery, and internal teams.\n\nMaintain and improve response playbooks based on lessons learned from real investigations.\n\nParticipate in an on-call rotation to respond to security incidents outside business hours.\n\nAI Defensive Testing & Validation\nThreat model new and existing systems, including AI agents and services, to identify what could go wrong, what we would need to see to catch it, and how we would respond.\n\nLead defensive testing, purple-teaming, and adversarial validation exercises to test alert fidelity and evaluate detection resilience against AI-driven threats.\n\nPartner with Platform and Engineering teams to ensure new AI services and features expose necessary logging and telemetry for effective security monitoring.\n\nEvaluate authorization and access-control changes for security-relevant blast radius, and drive remediation with the engineering teams that own the affected systems.\n\nThreat Intelligence\nOperationalize threat intelligence into actionable detections and tracked follow-up work.\n\nCoordinate indicator of compromise (IOC) blocking across endpoint, network, and web layers.\n\nWhat You Bring to the Table\n8+ years of experience in detection engineering, incident response, or security engineering, with demonstrated leadership in shaping organizational security strategy.\n\nPractical experience incorporating AI tooling into SecOps workflows, along with familiarity with detection strategies for AI-specific threat vectors.\n\nStrong scripting/automation skills (Python, JavaScript, or similar) and experience building workflows in a SOAR-style or workflow automation platform.\n\nExperience managing security controls as code (e.g., Terraform), with changes made through peer review rather than manual console changes.\n\nExperience securing cloud environments (AWS preferred) and modern SaaS/identity stacks.\n\nHands-on incident response experience: triage, investigation, containment, and postmortem/playbook development.\n\nWorking knowledge of adversary tradecraft (MITRE ATT&CK) and the ability to translate it into practical, tuned detections rather than noisy alerts.\n\nProven ability to partner directly with engineering and infrastructure teams to define telemetry and control requirements for systems you don't own.\n\nExcellent written communication. This role regularly turns investigation findings into clear, factual updates for technical and non-technical stakeholders alike.\n\nBonus if You Have\nExperience contributing to or building from open detection content, such as Sigma rules or community rule repos.\n\nExperience collaborating with red/purple-team exercises to validate detection coverage.\n\nExperience supporting a healthcare, regulated, or otherwise highly sensitive-data environment.\n\nRelevant certifications (GCIH, GCFA, GCTI, GCDA, or equivalent practical experience).\n\nWhat we can offer you:\nGenerous PTO and competitive pay \nFullscript’s RRSP match program for financial health \nFlexible benefits package and workplace wellness program\nTraining budget and company-wide learning initiatives \nDiscount on Fullscript catalog of products \nAbility to work Wherever You Work Well*\n*Our Wherever You Work Well philosophy means Fullscript teammates get to pick their own office - whether that’s in-office, at home, or a bit of both","description_format":"text","description_chars":6073,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["E-commerce Platforms","Dietary Supplements"],"lifecycle":[{"event":"open","at":"2026-10-15T21:57:24Z"}],"visa":[{"country":"CA","licensed_sponsor":true,"evidence":"Positions approved through LMIA in 12 months: 2","filings_12m":2,"filings_prev_12m":1,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"High Wage; Global Talent Stream","cap_exempt":false,"checked_at":"2026-10-03T21:10:52+00:00","sources":["ESDC: employers issued a positive LMIA"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":45,"reasons":["conf:0","win:early"],"computed_at":"2026-10-16T02:05:09Z"},"pay":null,"html_url":"https://alion.io/job/fullscript-staff-security-engineer-ai-driven-detection-response","json_url":"https://alion.io/job/fullscript-staff-security-engineer-ai-driven-detection-response.json","meta":{"generated_at":"2026-10-16T02:05:09Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3342,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-17T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":9061},"rest":"https://alion.io/mcp/rest/get_company?id=9061"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffullscript-staff-security-engineer-ai-driven-detection-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffullscript-staff-security-engineer-ai-driven-detection-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffullscript-staff-security-engineer-ai-driven-detection-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/fullscript-staff-security-engineer-ai-driven-detection-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffullscript-staff-security-engineer-ai-driven-detection-response"}]}