Staff Security Operations Specialist - Workleap

Company Description

Workleap is a Montreal-based tech company, founded in 2006. We're builders at heart, making simple products that matter to the people who use them. We have two product lines: Workleap Agent, our newest solution built to make every manager more effective, and ShareGate, the world's leading solution for Microsoft 365 migration and governance. More than 15,000 companies worldwide trust us. If you're excited by hard problems and want to help shape what comes next, there's a place for you here.

Your Role

You will own how Workleap detects, investigates, and responds to threats across Workleap and ShareGate, and build the AI layer that runs it. This role exists to turn detection and response into a system where agents triage, enrich, and investigate, allowing humans to make calls that genuinely require judgment. This is a hands-on Staff Individual Contributor (IC) role with no direct reports.

Your Impact

• Build the end-to-end security operations pipeline: integrations that pull alerts out of source tools, an agentic system that triages, enriches, correlates, and drafts investigations, and automatic routing to Jira with fix paths and evidence.
• Define the trust model for security agents, specifying what they close independently versus what requires human oversight, backed by evals and secured against prompt injection and permission abuse.
• Eliminate false positives and misrated findings at the source so every finding that reaches a person is actionable and prioritized.
• Own detection engineering as code mapped to MITRE ATT&CK to ensure resilient coverage across platform changes.
• Lead security incident response from triage to postmortem, using agents to gather evidence while holding managed detection partners to measurable standards.
• Collaborate with developers to deliver findings directly within their workflow with clear evidence and remediation guidance.

Your Team

LeapSec covers Security Operations and Compliance across Workleap and ShareGate. You will report to the Director of Infrastructure and Security and work daily with our Staff Application Security Specialist, security tooling team, Infrastructure, ITX, and product engineering.

Our environment is Azure-first, featuring a cloud-native SIEM and XDR stack, Zscaler, Cloudflare, and a managed detection partner.

What You'll Bring

• 7+ years in security operations, incident response, or detection engineering with recent hands-on experience in a cloud SaaS environment.
• Deep experience validating imperfect findings, tuning false positives at the source, and making decisions with incomplete evidence.
• Proven history of collaborating directly with developers to ship security fixes without direct authority.
• Experience building and shipping agentic systems for security work (e.g., MCP servers, Claude skills, subagents, custom tools) backed by evaluations.
• Strong understanding of failure modes and attack vectors in agentic systems, including prompt injection, tool permission scoping, and credential handling.
• Strong discipline in detection engineering as code, fluency in SIEM query languages, and active tracking of false positive rates.
• Strong grasp of identity and cloud attack paths, particularly within Azure and Entra ID.
• Bonus: Experience directing managed detection partners, threat hunting, digital forensics, or working proficiency in French.

What the Job Comes With

• Base salary: $125,000 - $160,000 CAD (Canada-wide scale, adjusted based on local market conditions).
• Annual bonus program and LTIP (long-term incentive plan) share options.
• RRSP matching, family health insurance, telemedicine, and an annual wellness budget.
• Flexible vacation policy.
• Remote work setup with access to the Montreal office and bi-annual in-person gatherings.
• Claude AI access for all employees.