Threat Operations & Detection Specialist

About This Role

The Threat Operations & Detection Specialist plays a crucial role in enhancing threat detection, response readiness, and cyber resilience within the technology environment at Dentons Canada LLP. This position is unique as it goes beyond traditional Security Operations Center (SOC) roles, focusing on governance of the Managed Detection and Response (MDR) service and leading detection engineering efforts.

Responsibilities

• Govern the MDR service to ensure high-quality monitoring, escalation, investigation support, reporting, and continuous improvement.
• Develop, tune, and maintain high-fidelity detection use cases across Microsoft Sentinel, Defender XDR, identity, endpoint, cloud, email, and network telemetry.
• Improve detection coverage using MITRE ATT&CK, threat intelligence, incident learnings, audit findings, and identified control gaps.
• Work with the MDR provider to reduce false positives, validate alerts, improve escalation quality, and ensure meaningful visibility into priority threats.
• Support log source onboarding, detection coverage assessments, analytics development, dashboarding, and operational reporting.
• Develop and maintain detection logic, response playbooks, and automation workflows that improve mean time to detect and contain security events.
• Conduct proactive threat hunting using SIEM, EDR/XDR, identity, cloud, email, network, and other relevant telemetry sources.
• Triage, investigate, and respond to escalated security alerts, incidents, and suspected compromise activity in partnership with the MDR provider and internal teams.
• Act as a technical responder for phishing, malware, account compromise, endpoint compromise, insider threat, suspicious access, and cloud security events.
• Support containment, eradication, recovery, forensic evidence collection, incident timelines, and post-incident reviews.
• Translate incident findings into improved detections, response procedures, preventive controls, and security awareness actions.
• Participate in incident tabletop exercises, purple team exercises, and response readiness activities.
• Monitor emerging threats relevant to professional services and legal environments, including identity compromise, ransomware, supply chain attacks, cloud abuse, API abuse, data theft, and AI-enabled phishing.
• Convert threat intelligence into practical detection use cases, hunting hypotheses, playbook improvements, and preventive recommendations.
• Produce operational threat reports and detection metrics to inform stakeholders.

Requirements

• Proven experience in threat detection, incident response, and security operations.
• Strong knowledge of security technologies, including SIEM, EDR/XDR, and cloud security solutions.