[All remote jobs](https://jobicy.com/jobs.md)[![Workleap logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/b84329e1-221.png)](https://jobicy.com/company/workleap.md)[Workleap](https://jobicy.com/company/workleap.md) # Staff Security Operations Specialist, LeapSec AI Summary This Staff Security Operations Specialist role owns detection, investigation, response, and detection engineering across Workleap and ShareGate. The position focuses on building trusted AI agents that triage, enrich, correlate, and route security findings into developer workflows. It requires deep hands-on cloud security operations experience, especially in Azure, Entra ID, SIEM/XDR tooling, incident response, and MITRE ATT&CK. The specialist will reduce false positives, lead incident response, manage a detection partner, and work closely with engineering teams without direct reports. This is a high-impact individual contributor position in a small security team operating with fast-moving priorities and fixed delivery dates.[Apply for this job](#job-application)[View company](https://jobicy.com/company/workleap.md)ShareRemote from[Canada](https://jobicy.com/job-region/canada.md)SalaryCAD 140k–190k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceDirectorPublished12 Nov 2026Apply before12 Dec 2026Listing views50Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. Opportunity details ## About this role. ### Company Description [Workleap](https://jobicy.com/company/workleap.md) is a Montreal-based tech company, founded in 2006. We’re builders at heart, we make simple products that actually matter to the people who use them. We have two product lines: [Workleap Agent](https://workleap.com/), our newest solution built to make every manager more effective, and [ShareGate](https://sharegate.com/), the world’s leading solution for Microsoft 365 migration and governance. More than 15,000 companies worldwide trust us to do exactly that. We’re intentional about who joins us. If you’re the kind of person who gets excited by a hard problem and wants to help shape what comes next, there’s a place for you here. ### Your role You will own how Workleap detects, investigates and responds to threats across Workleap and ShareGate, and you will build the AI layer that runs it. Our security tooling generates more noise than a small team can work, and too many findings are ambiguous or wrong. This role exists now to turn detection and response into a system where agents triage, enrich and investigate, and people make the calls that genuinely need judgment. It is a hands on Staff individual contributor role with no direct reports. Your impact: * Build the pipeline that runs security operations end to end: integrations that pull alerts and findings out of every source tool, an agentic system that triages, enriches, correlates and drafts the investigation, and a connection into Jira that routes each result to the owning team with evidence and a fix path, so no finding is ever copied by hand. * Define the trust model for those agents, deciding what they close alone, what they recommend and what always goes to a human, backed by evals and secured against prompt injection and permission abuse. * Drive false positives and misrated findings out of our security tooling, so every finding that reaches a person is real and correctly prioritized. * Own detection engineering end to end, written as code and mapped to MITRE ATT&CK, so coverage survives any change of platform. * Lead security incident response from triage to postmortem, with agents gathering the evidence, and hold our managed detection partner to a measurable standard. * Make security a partner developers want to work with, delivering findings in their workflow with clear evidence and a fix path. ### Your team Over the next 12 months, LeapSec is delivering two strategic bets: putting security inside product squads, with agents carrying vulnerability and detection work, and automating SOC 2 evidence so nobody gathers it by hand. You will own the detection and response side of that work: cleaning up the tooling, building the agents, and proving how much they can be trusted to do alone. LeapSec covers Security Operations and Compliance across Workleap and ShareGate. You will report to the Director of Infrastructure and Security and work daily with our Staff Application Security Specialist and security tooling team, and as needed with Infrastructure, ITX and product engineering. We are a small team with a wide mandate: we track work honestly in Jira, deliver on fixed dates, and expect people to own outcomes end to end. Our environment is Azure first, with a cloud native SIEM and XDR stack, Zscaler, Cloudflare and a managed detection partner today. We choose tools on merit and expect to keep choosing. ### What you’ll bring * 7+ years in security operations, incident response or detection engineering, with recent hands on time in a cloud SaaS environment; * Deep experience working findings that are not clean: validating what tooling flags, tuning false positives out at the source, and deciding with incomplete evidence whether something is real; * Years of working directly with developers, getting fixes shipped without authority and keeping the relationship intact when the answer is no; * Built and shipped agent systems for security work that others depend on, such as MCP servers, Claude skills, subagents or custom tools, with evals that decide when the output is trusted; * A working model of how agentic systems fail and get attacked, including prompt injection, tool permission scoping and credential handling; * Detection engineering as a discipline: detections as code, a SIEM query language you write fluently, and false positive rates you actually measure; * Strong grasp of identity and cloud attack paths, ideally in Azure and Entra ID; * Bonus: experience directing a managed detection partner, threat hunting or forensics, and working proficiency in French. Most of this sounds like you? Apply. ### What the job comes with * Base salary: $140 000 – $190 000. This range reflects our Canada-wide compensation scale. Final offers may be adjusted based on the candidate’s region to align with local market conditions. * Annual bonus program. * LTIP program, share in Workleap’s long-term growth. * RRSP + Family health insurance + telemedicine + annual wellness budget. * Flexible vacation policy. * Remote work, with access to our Montreal office. * In-person gatherings twice a year. * Claude access, for everyone. ### What drives us At Workleap, we build software that sits at the center of how people experience work, every day, at every level. We move fast. Priorities shift, decisions get made with the information we have, and we iterate. If you thrive on intensity and ambiguity doesn’t slow you down, you’ll feel right at home. We’re builders. We do what it takes to move forward. AI is part of our toolkit. We use it to go faster and decide smarter, not to replace judgment. If you want real impact and a place where your decisions matter, this is it. ### How we hire Transparency is how we hire — for you as much as for us. Here’s how it works: a first call with a recruiter, then a virtual interview with the hiring manager. You’ll then complete a take-home case study, followed by a meet with future colleagues to discuss it together. Depending on the role, the process may vary slightly — your recruiter will walk you through it on your first call. We use AI to support certain steps of the process, but every hiring decision remains human. We can’t wait to meet you. By applying, you confirm that you have read and agree to our [privacy policy](https://workleap.com/trust-center/privacy). #LI-Remote Show more [Apply now >](https://jobicy.com/jobs/161595-staff-security-operations-specialist-leapsec.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThe role combines staff-level security operations ownership with AI-agent architecture, detection engineering, incident leadership, and adversarial AI security. It requires independent judgment under ambiguity and the ability to influence developers and external detection partners without formal authority. ## Salary analysis Estimated compensation compared with the broader CA market for similar roles. Estimated job median (per year)Market rateC$165,000CA market range (per year)C$150k–C$210k0C$231.00k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. The employer discloses a base salary range of CAD 140,000 to CAD 190,000. The annual cadence is inferred from the full-time staff-level security role and the scale of the stated Canadian compensation range. A reasonable estimated Canadian market range for a staff-level security operations and detection engineering specialist is CAD 150,000 to CAD 210,000 annually. ## Core skills Skills and capabilities most closely associated with this opportunity. [Security Operations](https://jobicy.com/jobs?search_keywords=Security%20Operations.md)[Incident Response](https://jobicy.com/jobs?search_keywords=Incident%20Response.md)[Detection Engineering](https://jobicy.com/jobs?search_keywords=Detection%20Engineering.md)[SIEM](https://jobicy.com/jobs?search_keywords=SIEM.md)[XDR](https://jobicy.com/jobs?search_keywords=XDR.md)[Azure Security](https://jobicy.com/jobs?search_keywords=Azure%20Security.md)[Microsoft Entra ID](https://jobicy.com/jobs?search_keywords=Microsoft%20Entra%20ID.md)[MITRE ATT&CK](https://jobicy.com/jobs?search_keywords=MITRE%20ATTCK.md)[Threat Hunting](https://jobicy.com/jobs?search_keywords=Threat%20Hunting.md)[Security Automation](https://jobicy.com/jobs?search_keywords=Security%20Automation.md)[AI Agents](https://jobicy.com/jobs?search_keywords=AI%20Agents.md)[Prompt Injection Defense](https://jobicy.com/jobs?search_keywords=Prompt%20Injection%20Defense.md)[Jira](https://jobicy.com/jobs?search_keywords=Jira.md)[Cloud Security](https://jobicy.com/jobs?search_keywords=Cloud%20Security.md)[Security Incident Management](https://jobicy.com/jobs?search_keywords=Security%20Incident%20Management.md) Sample interview questionsHow would you design an AI-assisted security alert triage workflow while preserving human control over high-risk decisions?I would begin by classifying actions according to risk and reversibility. Low-risk enrichment, correlation, and evidence collection can be automated, while containment, account changes, and case closure should require defined confidence thresholds or human approval. I would implement evaluations, audit trails, least-privilege tool access, and recurring quality reviews to measure false positives and unsafe agent behavior. Describe your approach to reducing false positives in a cloud SIEM environment. I start by measuring alert volume, analyst disposition, detection precision, and business impact. I validate the underlying telemetry and detection logic, identify recurring benign patterns, and tune rules using contextual signals such as asset criticality, identity behavior, and known approved processes. I document changes as code, test them against representative data, and monitor results after deployment. How do you map detections to MITRE ATT&CK without creating a purely compliance-driven detection program? I use ATT&CK as a structured coverage and prioritization model rather than a checklist. Each detection should address a realistic threat scenario, identify the relevant telemetry, define expected investigative evidence, and have an owner and quality metric. I prioritize techniques based on the organization’s cloud architecture, identity exposure, business risk, and observed attacker behavior. What controls would you apply to protect security agents from prompt injection and permission abuse? I would isolate untrusted input, use strict schemas for tool calls, minimize credentials and permissions, and separate data retrieval from privileged actions. Agents should not treat alert content, tickets, or external artifacts as instructions. I would also use allowlisted tools, policy enforcement, output validation, red-team testing, and complete logs for every agent decision and action. How would you influence product engineers to remediate security findings when you do not have direct authority? I would provide concise, evidence-based findings in the team’s existing workflow, explain the practical risk, and include a prioritized fix path that is easy to act on. I would collaborate early, account for delivery constraints, and use service-level expectations for material risks. Building credibility through accurate findings and useful remediation guidance is essential for sustained partnership. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Latent logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/c872d1ae22b7-221.webp) Latent Nov 12 New ### [Security Engineer](https://jobicy.com/jobs/161597-security-engineer-7.md) About Latent Latent is the enterprise pharmacy intelligence platform, powered by a clinical agentic engine, that enables health systems to grow their pharmacy operations and serve more patients. One engine… * ![Samsara logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/dd26f5ca-221.jpg) Samsara Nov 12 New ### [Senior Security Engineer – Enterprise Security](https://jobicy.com/jobs/161583-senior-security-engineer-enterprise-security.md) Who we are Samsara (NYSE: IOT) is the pioneer of the Connected Operations™ Cloud, which is a platform that enables organizations that depend on physical operations to harness Internet of… * ![Bogaard Group International logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/11/1ccf014fc152-221.webp) Bogaard Group International Nov 12 New ### [Lead Security Systems Solutions Engineer](https://jobicy.com/jobs/161571-lead-security-systems-solutions-engineer.md) Position Overview We are looking for an experienced Lead Security Systems Solutions Engineer to be embedded at a leading global technology and entertainment company. The Lead Security Systems Solutions Engineer… * ![Dropbox logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200923071227-398427.jpg) Dropbox Nov 12 New ### [Security Engineer, IAM](https://jobicy.com/jobs/161544-security-engineer-iam.md) Role Description Security Engineers at Dropbox safeguard our digital ecosystem alongside a diverse team of professionals dedicated to protecting our products and users. Trusted by millions, our mission is to… * ![Fleetio logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/07/e571b83c37e0ed5371754d319be16e76.jpeg) Fleetio Nov 12 New ### [Senior Security Operations Engineer](https://jobicy.com/jobs/161527-senior-security-operations-engineer-5.md) A little about us…Fleetio is a modern software platform that helps thousands of organizations worldwide manage their fleet operations. Transportation technology is a hot market, and we’re leading the charge… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Nov 12 New ### [Senior Blockchain Intelligence Analyst, Ransomware](https://jobicy.com/jobs/155136-senior-blockchain-intelligence-analyst-ransomware.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Nov 12 New ### [Security Operations Analyst- Ireland](https://jobicy.com/jobs/155141-security-operations-analyst-ireland.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 12 New ### [Blockchain Security Expert – Chain Security Evaluation Track](https://jobicy.com/jobs/152970-blockchain-security-expert-chain-security-evaluation-track.md) About You You’re a self-starter who thrives on tackling the toughest and most meaningful problems, even if they are the most difficult problems. You’re comfortable with the unknown and understand… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 12 New ### [Blockchain Security Expert – Anti Defect Track](https://jobicy.com/jobs/152966-blockchain-security-expert-anti-defect-track.md) About the Company Founded in 2018 by professors of Yale University and Columbia University, CertiK is a pioneer in blockchain security, utilizing best-in-class AI technology to secure and monitor blockchain… * ![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg) CertiK Nov 12 New ### [Blockchain Security Expert – Security Audit Track](https://jobicy.com/jobs/152975-blockchain-security-expert-security-audit-track.md) About You You’re a self-starter. You believe in tackling the most important problems, even if they are the most difficult problems. You’re comfortable with the unknown and understand that #startuplife… [Browse all jobs](https://jobicy.com/jobs.md)