Threat Operations & Detection Specialist

Dentons is designed to be different. Our Firm leads the way in a rapidly changing legal marketplace. We challenge the status quo and deliver consistent results as well as uncompromising quality and value to our clients. Our global presence is renowned as a firm with over 21,000 individuals in more than 200 offices serving clients across 80+ countries.

Dentons Canada is committed to its people and communities. We are consistently recognized as an employer of choice having received numerous awards including being selected as one of Canada’s Top 100 Employers (2026); Canada’s Top Employers for Young People (2026), and Canada’s Best Diversity Employers (2026).

This role is an opportunity for you to join Canada's Global Law Firm, a firm that offers opportunities to build your career while growing your skills and deepening your expertise.

ROLE

Dentons Canada LLP is currently recruiting for a Threat Operations & Detection Specialist who will be responsible for continuously improving threat detection, response readiness, and cyber resilience across the Canada technology environment. This role is not a traditional SOC (Security Operations Center) position. The candidate will govern the Managed Detection and Response (MDR) service, lead detection engineering, support incident response, perform threat hunting, and act as a technical escalation and backup for operational security requests when required.

KEY RESPONSIBILITIES & ACCOUNTABILITIES

MDR Governance & Detection Engineering

• Govern the MDR service to ensure high-quality monitoring, escalation, investigation support, reporting, and continuous improvement.

• Develop, tune, and maintain high-fidelity detection use cases across Microsoft Sentinel, Defender XDR, identity, endpoint, cloud, email, and network telemetry.

• Improve detection coverage using MITRE ATT&CK, threat intelligence, incident learnings, audit findings, and identified control gaps.

• Work with the MDR provider to reduce false positives, validate alerts, improve escalation quality, and ensure meaningful visibility into priority threats.

• Support log source onboarding, detection coverage assessments, analytics development, dashboarding, and operational reporting.

• Develop and maintain detection logic, response playbooks, and automation workflows that improve mean time to detect and contain security events.

Threat Hunting, Incident Response & Technical Investigation

• Conduct proactive threat hunting using SIEM, EDR/XDR, identity, cloud, email, network, and other relevant telemetry sources.

• Triage, investigate, and respond to escalated security alerts, incidents, and suspected compromise activity in partnership with the MDR provider and internal teams.

• Act as a technical responder for phishing, malware, account compromise, endpoint compromise, insider threat, suspicious access, and cloud security events.

• Support containment, eradication, recovery, forensic evidence collection, incident timelines, and post-incident reviews.

• Translate incident findings into improved detections, response procedures, preventive controls, and security awareness actions.

• Participate in incident tabletop exercises, purple team exercises, and response readiness activities.

Threat Intelligence, Emerging Threats & Continuous Improvement

• Monitor emerging threats relevant to professional services and legal environments, including identity compromise, ransomware, supply chain attacks, cloud abuse, API abuse, data theft, and AI-enabled phishing.

• Convert threat intelligence into practical detection use cases, hunting hypotheses, playbook improvements, and preventive recommendations.

• Produce operational threat reports, detection coverage summaries, incident trends, and metrics for Security leadership and stakeholders.

• Collaborate with the Information Security Design Specialist and Cloud & Vulnerability Specialist to ensure threat intelligence informs architecture, configuration, and exposure reduction priorities.

• Identify opportunities for SOAR, automation, AI-assisted investigation, and process improvement across detection and response workflows.

Security Services Backup & Operational Escalation

• Support escalated phishing investigations, security mailbox inquiries, high-risk URL or web filtering requests, DLP alerts, exception reviews, and operational security tickets when required.

• Provide coaching, quality review, and technical guidance to the Security Services function for phishing triage, evidence gathering, ticket enrichment, escalation paths, and operational procedures.

• Ensure operational work is documented, repeatable, and improved through runbooks, knowledge articles, automation, and clear escalation criteria.

SKILLS & COMPETENCIES

• Strong hands-on experience in cybersecurity operations, incident response, threat hunting, detection engineering, or MDR/SOC environments.

• Strong knowledge of Microsoft Sentinel, Defender XDR, EDR, SIEM, identity security, cloud telemetry, email security, and modern detection techniques.

• Understanding of MITRE ATT&CK, threat actor tactics, incident response lifecycle, forensic evidence handling, and operational security workflows.

• Ability to analyze alerts, logs, IOCs, behavioural indicators, and suspicious activity to determine risk and recommend appropriate response actions.

• Experience developing detections, tuning analytics, improving alert fidelity, and creating playbooks or runbooks for repeatable response activities.

• Ability to work effectively with MDR providers, infrastructure teams, identity teams, service desk teams, legal/privacy stakeholders, and business users.

• Strong written and verbal communication skills with the ability to document investigations and explain technical findings clearly.

• Ability to remain calm under pressure and provide practical, risk-based guidance during security incidents and operational escalations.

EDUCATION, EXPERIENCE & CERTIFICATIONS

• Post-secondary education in Information Technology, Computer Science, Cybersecurity, or a related discipline, or equivalent practical experience.

• Minimum 5+ years of experience in cybersecurity operations, incident response, threat hunting, detection engineering, SOC, MDR, or related security roles.

• Hands-on experience with SIEM and XDR/EDR platforms such as Microsoft Sentinel, Microsoft Defender XDR, Splunk, QRadar, CrowdStrike, or similar technologies.

• Experience investigating phishing, malware, account compromise, endpoint compromise, suspicious authentication, cloud security alerts, and other security events.

• Experience working with MDR, MSSP, or SOC providers, including alert escalation, service quality review, reporting, or detection improvement.

• Familiarity with SOAR, automation, threat intelligence platforms, vulnerability intelligence, and security orchestration workflows is an asset.

• Familiarity with Microsoft security technologies including Defender for Endpoint, Defender for Identity, Defender for Cloud, Defender for Office 365, Entra ID, and Sentinel is preferred.

• Certifications such as GCIA, GCED, GCIH, GCFA, GNFA, CISSP, CISM, Microsoft Security, or equivalent are preferred.

We thank all applicants for their interest, however, only those selected for an interview will be contacted.

This role is a new position.

The target salary range for this position is $110,000 to $125,000, commensurate with the successful candidate’s skills, experience, and qualifications. Dentons is committed to equitable and competitive compensation.