Staff Security Operations Specialist, LeapSec

Your role

You will be responsible for how Workleap detects threats, investigates them and responds to them, at Workleap as well as at ShareGate, and you will build the AI layer that powers all of it. Our security tools generate more noise than a small team can handle, and too many findings are ambiguous or wrong. This role exists to turn detection and response into a system where agents triage, enrich and investigate, and where humans make the decisions that truly require judgement. This is a very hands-on, individual contributor Staff-level role, with no people management.

Your impact:

• Build the pipeline that runs security operations end to end: the integrations that extract alerts and findings from each source tool, an agentic system that triages, enriches, correlates and drafts the investigation, and a connection to Jira that routes each result to the responsible team with the evidence and a path to remediation, so that no finding is ever copied by hand;
• Define the trust model for these agents: what they close on their own, what they recommend, and what always goes back to a human, backed by evals and protected against prompt injection and permission abuse;
• Eliminate false positives and poorly assessed findings from our security tools, so that every finding that reaches a person is real and well prioritised;
• Lead detection engineering end to end, written as code and aligned to MITRE ATT&CK, so that coverage survives any change of platform;
• Lead security incident response, from triage to postmortem, with agents gathering the evidence, and hold our managed detection partner to a measurable standard;
• Make security a partner that development teams want to have, by delivering findings within their workflow with clear evidence and a path to remediation.

Your team

Over the next 12 months, LeapSec is delivering two strategic bets: embedding security into product squads, with agents carrying vulnerability and detection work, and automating SOC 2 evidence collection so that no one has to do it by hand. You will be responsible for the detection and response side: cleaning up the tooling, building the agents and demonstrating how far we can trust them.

LeapSec brings together Security Operations and Compliance for Workleap and ShareGate. You will report to the Infrastructure and Security directorate and work day to day with our Staff Application Security specialist and the security tooling team, and as needed with Infrastructure, ITX and product engineering. We are a small team with a broad mandate: we track work honestly in Jira, we deliver to fixed dates, and we expect everyone to own their results end to end.

Our environment is Azure first, with today a cloud-based SIEM and XDR platform, Zscaler, Cloudflare and a managed detection partner. We choose our tools on merit and intend to keep doing so.

What you bring

• Fluency in English is required, as you will regularly collaborate with colleagues, clients and partners who speak a language other than French;
• 7 years or more in security operations, incident response or detection engineering, with recent hands-on experience in a cloud SaaS environment;
• Solid experience with unclear findings: validating what tools flag, eliminating false positives at the source, and deciding, with incomplete evidence, whether something is real;
• Years of working directly with development teams, getting fixes delivered without formal authority and preserving the relationship when the answer is no;
• Experience building and deploying security agent systems that others depend on, such as MCP servers, Claude skills or custom tools, with evals that determine when their outputs can be trusted;
• A good understanding of how agentic systems fail and are attacked, notably prompt injection and the management of tool and credential permissions;
• Detection engineering as a discipline: detections written as code, a SIEM query language you have mastered, and false positive rates that are actually measured;
• A solid understanding of identity- and cloud-related attack paths, ideally in Azure and Entra ID;
• A plus: experience leading a managed detection partner, in threat hunting or in forensics, and fluency in French.

Does most of this sound like you? Apply.

What the role includes

• Base salary: $125,000 - $160,000 CAD. This range reflects our pan-Canadian salary scale. The final offer may be adjusted according to the candidate's region to align with local market conditions.
• Annual bonus programme.
• LTIP programme, sharing in Workleap's long-term growth.
• RRSP + family group insurance + telemedicine + annual wellness budget.
• Flexible vacation policy.
• Remote work, with access to our Montréal offices.
• In-person gatherings twice a year.
• Claude available to everyone.