Security Incident Response Developer
Security Engineer · Junior · Full Time · Remote
Opens Wealthsimple Technologies's application page
Role
What you'll do.
Wealthsimple Technologies is seeking a Security Incident Response Developer to join their Detection & Response team in Toronto. This Junior-level role focuses on investigating real-world security incidents, building automation workflows, and developing incident response capabilities for a fintech platform serving 4+ million Canadians. The ideal candidate brings 3+ years of cybersecurity experience with 1-2+ years of hands-on incident response, proficiency with SIEM/SOAR platforms, cloud infrastructure knowledge, and expertise in security automation using AI coding tools.
Responsibilities
- Incident Investigation and Response Leadership: Own end-to-end security incident investigations including triage, evidence collection, forensic analysis, containment, and comprehensive documentation. Act as Incident Commander for low- to medium-severity security incidents while supporting senior responders on high-severity events, coordinating across multiple stakeholders and knowing when to escalate for optimal incident resolution.
- Incident Response Automation and Process Improvement: Design and implement scalable automation workflows that convert recurring incident patterns into repeatable processes. Build security playbooks, develop detection rules based on incident trends, and create tooling solutions (including Slack bots and AI agents) that reduce manual response tasks and allow the team to focus on strategic decision-making.
- SIEM and SOAR Platform Development: Collaborate with Security Engineers to monitor, refine, and expand SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation and Response) platforms. Write complex queries, tune detection rules to reduce false positives, and develop high-fidelity detection capabilities that improve signal-to-noise ratios for the security operations center.
- Cross-functional Security Operations: Work with HR, Fraud, and Privacy teams to investigate sensitive security matters including insider threats, suspicious activity monitoring, and potential fraudulent behavior. Maintain discretion when handling confidential information and provide clear, honest communication with both internal stakeholders and external parties during security investigations.
- Detection Engineering and Threat Intelligence Integration: Partner with the detection engineering team to develop new security detection rules informed by incident trends, threat intelligence, and emerging attack patterns. Provide incident metrics and trend analysis that guide team priorities and inform strategic security investments for the fintech organization.
- On-Call Incident Response Support: Participate in a structured on-call rotation to respond to time-sensitive security incidents, operational support requests, and urgent internal security questions. Demonstrate strong judgment under pressure, technical problem-solving capability, and cross-team collaboration during high-stress incident response scenarios.
Qualifications
What we look for.
Technical
SIEM Query Development and Alert Tuning
Demonstrated experience using Security Information and Event Management (SIEM) platforms to aggregate security logs, develop custom queries, create detection rules, and tune alerts to minimize false positives while maximizing threat detection accuracy in high-volume environments.
Cloud Infrastructure Investigation
Working knowledge of cloud platforms (AWS, GCP, or Azure) including log collection, identity and access management, network forensics, and incident investigation techniques specific to cloud-native architectures and containerized environments.
AI-Assisted Automation and Coding
Proficiency with modern AI coding tools (Claude Code, Cursor, ChatGPT, or equivalent) to write, review, and maintain security automation scripts, incident response playbooks, and operational tooling that leverage artificial intelligence for efficiency gains.
Incident Response Methodology
Deep understanding of incident response frameworks including NIST, SANS, or equivalent methodologies. Ability to apply structured approaches to threat analysis, evidence preservation, chain of custody, and forensic investigation across multiple incident types.
Security Workflow Automation
Ability to analyze complex, unstructured security problems and decompose them into automated workflows. Strong understanding of how to architect solutions that leverage both traditional tooling and modern AI to handle security operations at scale.
Education
Bachelor's Degree in Computer Science or Related Field
Preferred foundation in computer science, cybersecurity, information technology, or related discipline. Demonstrates systematic understanding of computing principles, security architecture, and technical problem-solving relevant to security incident response.
Security Certifications
Industry-recognized certifications such as CEH (Certified Ethical Hacker), Security+, ECIH (EC-Council Certified Incident Handler), or GCIH (GIAC Certified Incident Handler) are valued as evidence of security expertise and incident response knowledge.
Experience
Cybersecurity Foundation
3+ years of professional experience in cybersecurity roles, providing a solid foundation in security principles, threat models, vulnerability assessment, and security operations fundamentals relevant to a fintech environment.
Hands-On Incident Response
1-2+ years of direct, hands-on experience managing security incidents from initial detection through closure. This includes real-world exposure to breach investigations, malware analysis, access control violations, and active threat response in production environments.
Security Operations Center (SOC) Background
Hands-on exposure to security operations, whether through SOC analyst roles, detection engineering teams, or security engineering positions. Experience with log analysis, alert investigation, and the fundamentals of converting security data into actionable intelligence.
Skills
Required
Incident Coordination and Escalation
Proven ability to coordinate multiple responders and stakeholders during active security incidents, make sound judgment calls on escalation timing, and communicate technical findings to both technical and non-technical audiences.
SIEM Platform Expertise
Hands-on proficiency with Security Information and Event Management platforms, including query writing, alert configuration, rule tuning, and the ability to extract meaningful signals from high-volume security data.
Cloud Security Investigation
Working knowledge of cloud infrastructure providers (AWS, GCP, Azure) sufficient to investigate security incidents in cloud-native environments, including IAM auditing, log analysis, and network forensics in cloud architectures.
AI-Powered Automation
Proficiency with AI coding assistants and the ability to leverage them to build, test, and maintain security automation that reduces manual toil and improves incident response velocity.
Problem Decomposition and Workflow Design
Strong analytical ability to take recurring security problems and break them into discrete, automatable steps. Capacity to design workflows that tooling and AI agents can execute, freeing skilled responders for higher-judgment tasks.
Judgment Under Pressure
Demonstrated capability to maintain composure and make sound technical and operational decisions during high-stress incident response scenarios, with strong problem-solving skills and cross-functional collaboration abilities.
Confidentiality and Discretion
Strong judgment and ability to maintain absolute discretion when handling sensitive information including HR matters, insider threat investigations, privacy-related incidents, and potentially fraudulent activity.
Clear Technical Communication
Ability to communicate complex security findings, incident timelines, and technical analysis clearly and honestly to both internal security teams and external stakeholders, including non-technical executives and regulatory parties.
Preferred
SOAR Platform Experience
Nice to haveHands-on experience with Security Orchestration, Automation and Response (SOAR) platforms such as Splunk Soar, Demisto, or Cortex. Experience building playbooks and orchestrating multi-tool security workflows is highly valued.
Threat Intelligence Integration
Nice to haveExperience incorporating external threat intelligence, attack pattern analysis, and threat modeling into incident response workflows and detection rule development for improved context during investigations.
Insider Threat Program Exposure
Nice to havePrior experience participating in insider threat detection, investigation, or response programs. Familiarity with behavioral analysis, user activity monitoring, and the nuanced investigation approach required for sensitive HR-related security matters.
Fintech Security Knowledge
Nice to haveUnderstanding of financial services security requirements, compliance frameworks (PCI DSS, PIPEDA, SOC 2), and the specific threat landscape and regulatory environment within fintech and banking technology sectors.
Programming and Scripting
Nice to haveComfort with Python, Bash, or similar scripting languages. While AI tools are embraced at Wealthsimple, foundational programming knowledge enables more sophisticated automation development and deeper understanding of code quality.
Detection Engineering
Nice to havePrior exposure to detection rule development, alert engineering, or working closely with detection engineering teams to understand how incident trends inform and improve security detection capabilities.
Continuous Learning Orientation
Nice to haveTrack record of self-directed learning, professional development, and curiosity about emerging security threats, tools, and incident response techniques. Comfort evolving skills alongside rapidly changing threat landscape.
Tech stack
Languages
Frameworks
Databases
Tools
Other
Compensation
Pay and benefits.
Base·CAD 123,200 – 154,000
Equity·Stock options
Benefits
Top-Tier Health and Life Insurance
Comprehensive health coverage including dental, vision, and prescription benefits, paired with competitive life insurance to protect you and your family.
Long-Term Savings with Employer Match
Group savings plan administered through Wealthsimple for Business with employer matching contributions, helping you build long-term wealth and retirement security.
Generous Paid Time Off
20 vacation days annually plus 4 dedicated wellness days to recharge and focus on personal well-being. Unlimited paid sick days and mental health days reflect Wealthsimple's commitment to employee health.
90-Day Remote Work Flexibility
Opportunity to work remotely from outside Canada for up to 90 days per year, enabling you to maintain flexibility and explore different work environments without geographical constraints.
Employee Resource Groups
Active community groups including Rainbow (2SLGBTQ+), Women of Wealthsimple, and Black at Wealthsimple that foster inclusion, mentorship, and professional development opportunities.
Hybrid Work Environment
Collaborative hybrid setup with over 1,500 employees across North America. Work with talented, curious, and driven teammates in a distributed environment that balances in-office collaboration with remote flexibility.
Accessibility Accommodations
Wealthsimple is committed to providing accessibility support throughout your employment. The company actively accommodates diverse needs and welcomes feedback on how to better serve employees with accessibility requirements.
Full posting
Original listing.
Build something people love
Wealthsimple is Canada’s leading financial innovator. The company offers a full suite of simple, sophisticated financial products across managed investing, do-it-yourself trading, cryptocurrency, tax filing, spending and saving. Wealthsimple currently serves more than 4 million Canadians and holds over $169 billion in assets under administration. The company was founded in 2014 by a team of financial experts and technology entrepreneurs, and is headquartered in Toronto, Canada.
We're proud of what we've built — and we're just getting started. Read our Culture Manual and learn more about how we work.
About the role
We are looking for a curious, hands-on security professional early in their career to join our Detection & Response team as an Incident Response Developer. You’ll report to the Manager of Detection & Response and work closely with senior responders to investigate security incidents, improve our response processes and build automation that helps us scale. You’ll get hands-on experience with real incidents and the mentorship to grow into the craft.
The ideal candidate has a foundation in security fundamentals, some hands-on exposure to investigations or security operations, and real enthusiasm for automating repetitive work. You’re a problem-solver who stays calm when things get busy, asks good questions and wants to learn from experienced teammates.
What you'll do
Strengthen our incident response capabilities by building relationships with Engineering teams, writing new playbooks and automating manual steps.
Own investigations from start to finish: triage, evidence collection, analysis, containment and documentation.
Act as Incident Commander for low- and medium-severity incidents, and support senior responders on high-severity ones.
Turn recurring incident types into repeatable workflows (intake, playbook, automation, closure), from the first design through to the tooling behind them.
Report incident trends and metrics that inform team priorities.
Work with our Security Engineers to monitor, refine and expand our SIEM and SOAR platforms.
Work with the HR, Fraud and Privacy teams on investigations into potentially fraudulent and sensitive activity, including insider threats and snooping.
Participate in an on-call rotation for responding to security incidents, internal questions and operational support.
Work with the detection engineering team to develop new, high-fidelity detection rules based on incident trends and threat intelligence.
Skills you bring
3+ years of experience in cybersecurity.
1–2+ years of hands-on incident response experience, owning investigations end to end.
The ability to coordinate responders and stakeholders during an incident, and know when to escalate.
Experience using a SIEM to turn noise into signal, including writing queries and tuning alerts.
Proficiency with AI coding tools (Claude Code, Cursor, ChatGPT, etc.) to build and maintain automation. We invest in tooling (automation, Slack bots, AI agents) so responders spend their energy on the decisions that matter.
A workflow mindset: you can look at a messy, recurring problem and break it into steps that tooling or AI can take on.
Working knowledge of cloud infrastructure (e.g., AWS, GCP or Azure) and how to investigate within it.
Discretion and sound judgment when handling sensitive information, such as HR and insider-threat matters.
Clear, honest and inclusive communication with both internal and external stakeholders.
Good judgment under pressure, in technical problem solving and in working across teams.
A strong desire to learn from the team and others. We value making one another successful!
Why Wealthsimple?
🌸 Top-tier health benefits and life insurance
📈 Long-term group savings with employer match, through Wealthsimple for Business
🌴 20 vacation days, 4 wellness days, and unlimited sick and mental health days per year*
✈️ 90 days away: work outside Canada for up to 90 days per year*
👥 Employee resource groups, including Rainbow (2SLGBTQ), Women of WS, and Black at WS
🌎 We are a hybrid team with over 1,500 employees across North America. The people are one of the best parts of working here: you'll collaborate with incredibly talented, curious, and driven teammates who are deeply committed to doing great work.
*Unlimited paid sick days, Wellness Days and the 90 day away program do not apply to certain roles.
ICYMI
Technology & Innovation at Wealthsimple: We move quickly and build thoughtfully. That means we're always looking for better ways to work — whether that's new tools, AI, or rethinking how we approach a problem. We don't expect you to have all the answers, but we do expect curiosity and a willingness to evolve alongside the products we're building.
Inclusion Statement: We're building products for a diverse world, and we need a diverse team to do it well. We strongly encourage applications from everyone, regardless of race, religion, colour, national origin, gender, sexual orientation, age, marital status, or disability status.
Accessibility Statement: We're committed to an accessible hiring experience. If you need any accommodations throughout the interview process, please let us know — we'll work with you to make sure you have what you need. We also welcome any feedback on how we can better accommodate candidates with accessibility needs.
AI in Hiring: We may use artificial intelligence (AI) tools to support parts of our hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our team but don't replace human judgment – all final hiring decisions are made by people. If you have questions about how your data is used, reach out to us.
Redirects to Wealthsimple Technologies's application page.
Other roles