The cybersecurity team at FYUL is deliberately small and execution-focused. Its engineering branch runs the company's security operations backbone: a large-scale telemetry and detection platform covering endpoints, network traffic, cloud workloads, and SaaS — a modern SIEM at its core, extended with substantial custom machine learning and AI agents that this team designs and builds itself. This senior engineer role, reporting directly to the Information Security Engineering Manager, owns significant parts of that platform: detection engineering, vulnerability discovery, cloud and endpoint security, data loss prevention, and the automation of security operations.
This is an individual-contributor position where professional growth comes from depth of expertise and ownership of outcomes. The security program is mature, with governance and compliance handled by a dedicated GRC function — so this role is about building and running security engineering, full-time.
Your daily tasks will include:
- Detection engineering. Design, implement, and tune detections across our security telemetry — SIEM rules as well as custom ML models for anomaly and risk detection. Triage alerts, investigate real incidents, and drive them to closure — including technical incident response and post-incident improvement.
- Cloud and platform security. Harden and monitor our AWS and Kubernetes (EKS) environments: workload security, IAM, container runtime defense, and configuration standards. Collaborate with engineering teams so security lands as enablement, not friction.
- Endpoint security. Own the health and hardening of the endpoint agent fleet across macOS, Windows, and Linux.
- Data loss prevention. Operate and extend DLP coverage across removable media, email, and SaaS channels: telemetry-driven detection of data exfiltration, tuned to keep false positives low.
- Security automation. Automate recurring operations and detection-to-response workflows — including AI-based agents and pipelines, which are already a working part of this program. Prefer integrating established tooling over bespoke development where it delivers the same outcome.
- Vulnerability discovery and management. Find infrastructure vulnerabilities yourself — through scanning, configuration review, and targeted penetration testing of our environments — then prioritize and drive remediation to closure. This is not an application security role: a dedicated sub-team covers appsec.
