{"id":2601086,"url":"https://alion.io/job/lululemon-cybersecurity-engineer-detection-engineer","title":"Cybersecurity Engineer - Detection Engineer","company":{"id":39416,"name":"Lululemon","domain":"lululemon.com","url":"https://alion.io/company/lululemon","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Avature","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Vancouver, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":66000,"max_usd":120000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":40},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Git","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-10-15T08:09:36Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-15T19:47:44Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"who we are\nlululemon is an innovative performance apparel company for yoga, running, training, and other athletic pursuits. Setting the bar in technical fabrics and functional design, we create transformational products and experiences that support people in moving, growing, connecting, and being well. We owe our success to our innovative product, emphasis on stores, commitment to our people, and the incredible connections we make in every community we're in. As a company, we focus on creating positive change to build a healthier, thriving future. In particular, that includes creating an equitable, inclusive and growth-focused environment for our people.\nAbout this team\nThe lululemon cybersecurity team enables lululemon to conduct its global operations in a secure manner and safeguard the trusted information of its guest and users. This is accomplished by understanding business risk as manifested through cybersecurity and compliance risk, and by maintain a high degree of employee awareness of all security and compliance topics. To further enhance our team, we are looking for a Cyber Detection & Automation Engineer.\nA day in the life\nThe Cybersecurity Engineer will be responsible designing, developing, and maintaining advanced threat detection logic and workflow automations across our security tools and platforms. You will work closely with SOC analysts, threat intelligence, and incident response commanders to ensure proactive and accurate detection of malicious activity in our environment.\nDesign, implement and automate high-fidelity detection rules using SIEM, EDR, and other telemetry sources (e.g. Sentinel, Defender, AWS, etc.) to improve efficiency and accuracy.\nMonitor and tune alerts to reduce false positives and improve signal-to-noise ratio.\nRegularly test and validate detection content to ensure its effectiveness and accuracy.\nCreate documentation and knowledge transfer materials for detections and engineering processes.\nPerform gap analysis and continuously improve detection coverage, accuracy, and resilience.\nDesign and develop security automations workflows using SOAR (Security Orchestration, Automation, and Response) primarily using Microsoft Sentinel/Logic Apps.\nBuild and maintain custom integrations with SIEM, EDR, Threat Intel feeds, ticketing systems, and other SOC tools.\nAutomate repetitive SOC tasks such as alert triage, enrichment, IOC lookups, and ticket creation.\nDevelop dashboards or utilities to improve visibility and operational insights into SOC metrics.\nCollaborate with security operations center analysts & threat intelligence to stay ahead of evolving adversary tactics (MITRE ATT&CK-based).\nCreate and update relevant runbooks, playbooks and other necessary documentation around detection rules and attacker TTP's.\nPrepare and present detailed reports on detection/automation activities, findings, and improvements to senior management. \nQualifications\nBachelor’s degree in cybersecurity, computer science, information technology, or related field. \n5+ years in cybersecurity, with 3+ years specifically in detection and automation engineering.\nProficiency in writing detection logic using KQL, SPL or other relevant query languages.\nExperience with query languages such as KQL, SPL and scripting languages (Bash, PowerShell, Python)\nProficient in developing automations using SOAR platforms, specifically Microsoft Sentinel/Logic AppsUnderstanding of SOC operations, incident response workflows, and threat detection techniques.\nExperience with RESTful APIs and integration of third-party tools.\nExperience in a cloud-first or hybrid cloud environment (preferably AWS and Azure).\nStrong knowledge of incident response methodologies, including NIST 800-61.\nStrong, practical knowledge of the MITRE ATT&CK framework, and how to map adversary behaviors to telemetry for detection design. \nDeep understanding of attacker TTPs, threat modeling, and detection methodologies.\nFamiliarity with version control (Git), CI/CD pipelines, and infrastructure as code concepts.\nExperience in using security orchestration, automation, and response tools.\nThe ability to effectively communicate both verbally and in writing to audiences of different technical skill levels.\nStrong analytical and troubleshooting abilities to investigate, identify and resolve security incidents quickly and effectively. \nAbility to collaborate cross-functionally in a fast-paced retail business environment.\nCapability to remain calm, composed, and focused during high-pressure situations, ensuring a clear and effective incident response. \nRelevant certifications such as:\n-Microsoft SC-200, Azure Security Engineer Associate\n-AWS Certified Security - Specialty\n-GIAC (GCIA, GCTI, GDAT), CISSP, or CISM\nmust haves\nAcknowledge the presence of choice in every moment and take personal responsibility for your life.\nPossess an entrepreneurial spirit and continuously innovate to achieve great results. \nCommunicate with honesty and kindness and create the space for others to do the same. \nLead with courage, knowing the possibility of greatness is bigger than the fear of failure. \nFoster connection by putting people first and building trusting relationships. \nIntegrate fun and joy as a way of being and working, aka doesn’t take yourself too seriously. \nadditional notes\nAuthorization to work in Canada is required for this role.\ncompensation and benefits package\nlululemon’s compensation offerings are grounded in a pay-for-performance philosophy that recognizes exceptional individual and team performance. The typical hiring range for this position is from $112,200 - 147,200CAD annually; the base pay offered is based on market location and may vary depending on job-related knowledge, skills, experience, and internal equity.. As part of our total rewards offering, permanent employees in this position may be eligible for our competitive annual bonus program , subject to program eligibility requirements.\nAt lululemon, investing in our people is a top priority. We believe that when life works, work works. We strive to be the place where inclusive leaders come to develop and enable all to be well. Recognizing our teams for their performance and dedication, other components of our total rewards offerings include support of career development, wellbeing, and personal growth:\nExtended health and dental benefits, and mental health plans \nPaid time off \nSavings and retirement plan matching \nGenerous employee discount \nFitness & yoga classes \nParenthood top-up \nExtensive catalog of development course offerings \nPeople networks, mentorship programs, and leadership series (to name a few) \nNote: The incentive programs, benefits, and perks have certain eligibility requirements. The Company reserves the right to alter these incentive programs, benefits, and perks in whole or in part at any time without advance notice.\n\nworkplace arrangement\nHybrid\nIn-person collaboration and connection isimportant to our culture. Work is performed onsite, minimum 4 days per week.","description_format":"text","description_chars":7021,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Retirement plans"],"hiring_locations":[{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Incident Response"],"lifecycle":[{"event":"open","at":"2026-10-15T08:09:36Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":23,"reasons":["conf:2","win:early","comp:brand"],"computed_at":"2026-10-15T22:47:16Z"},"pay":null,"html_url":"https://alion.io/job/lululemon-cybersecurity-engineer-detection-engineer","json_url":"https://alion.io/job/lululemon-cybersecurity-engineer-detection-engineer.json","meta":{"generated_at":"2026-10-15T22:47:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":34585,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":39416},"rest":"https://alion.io/mcp/rest/get_company?id=39416"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flululemon-cybersecurity-engineer-detection-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flululemon-cybersecurity-engineer-detection-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flululemon-cybersecurity-engineer-detection-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/lululemon-cybersecurity-engineer-detection-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flululemon-cybersecurity-engineer-detection-engineer"}]}