# Senior Security Incident Response Developer **Company:** [Wealthsimple Technologies](https://scaleengineer.com/companies/wealthsimple) Join Wealthsimple's Detection & Response team as a Senior Incident Response Developer, leading critical investigations and building scalable security incident response capabilities for Canada's largest financial technology platform serving 4 million users. This senior technical role combines hands-on incident management, team leadership, and security automation engineering to protect customer data and company infrastructure from evolving cyber threats. You'll design playbooks, mentor junior responders, and collaborate with detection engineering teams while maintaining on-call rotations for high-priority security incidents. **Role:** Security Engineer **Seniority:** Senior **Locations:** Remote (Canada) **Remote:** yes **Salary:** 151200–189000 CAD [Apply](https://jobs.ashbyhq.com/wealthsimple/1c468e02-4abf-452a-8952-aa5082b7157a) Canonical: https://scaleengineer.com/jobs/wealthsimple/senior-security-incident-response-developer --- ## Responsibilities - Lead Security Incident Investigations and Command: Take ownership as Incident Commander for complex security incidents, managing investigation workflows from initial detection through resolution. Coordinate cross-functional response efforts with Engineering, HR, Fraud, and Privacy teams to investigate insider threats, fraudulent activities, and sensitive security events affecting customer data. - Design and Optimize Incident Response Processes: Build repeatable, scalable workflows that transform recurring incident types into routine team operations. Create comprehensive playbooks covering intake, detection refinement, automated response steps, and closure procedures that improve response time and consistency across the security team. - Build Security Automation and Tooling: Develop AI-powered automation, Slack bots, and custom scripts that reduce manual toil and enable responders to focus on high-value decision-making. Leverage modern development tools and AI coding assistants to create efficient security workflows that scale with organizational growth. - Mentor and Develop Detection & Response Team: Lead the growth and development of incident responders through hands-on mentoring and knowledge sharing. Help shape the team's capabilities, consistency, and incident response maturity while fostering a collaborative culture focused on continuous learning and technical excellence. - Partner on Detection and SIEM/SOAR Enhancement: Collaborate with Security Engineers to monitor, refine, and expand SIEM and SOAR platform capabilities. Work with detection engineering teams to develop high-fidelity detection rules informed by incident trends, threat intelligence, and recurring threat patterns. - Establish Metrics and Strategic Direction: Analyze incident trends, metrics, and emerging threats to inform leadership of security program priorities and investment opportunities. Present data-driven recommendations to business stakeholders and executive leadership on security posture, response efficiency, and risk mitigation initiatives. - Maintain On-Call Response Availability: Participate in on-call rotation to provide 24/7 incident response, internal security consultations, and operational support. Respond rapidly to security incidents, maintaining composure and delivering clear technical guidance during high-pressure situations affecting millions of customers. - Build Cross-Functional Security Relationships: Establish strong working relationships with Engineering teams across Wealthsimple to improve security awareness, drive automation opportunities, and embed incident response best practices into development workflows. Act as a technical bridge between security and product development teams. ## Requirements ### education - {"name":"Bachelor's Degree in Computer Science or Related Field","description":"Preferred undergraduate degree in Computer Science, Computer Engineering, Information Security, or related technical discipline. Equivalent industry experience and certifications may substitute for formal educational requirements."} - {"name":"Security Industry Certifications","description":"Relevant security certifications such as CISSP (Certified Information Systems Security Professional), GIAC Certified Incident Handler (GCIH), Certified Ethical Hacker (CEH), or SANS certifications. Certifications demonstrate commitment to security engineering discipline and industry standards."} ### technical - {"name":"SIEM Platform Expertise","description":"Advanced proficiency with SIEM (Security Information and Event Management) platforms to filter noise, identify true security signals, and develop detection rules. Experience tuning alerts, managing false positive reduction, and interpreting log data across infrastructure and applications."} - {"name":"Incident Response Automation","description":"Hands-on experience building incident response automation using Python, Bash, or similar scripting languages. Proficiency with AI coding assistants (Claude Code, Cursor, ChatGPT) and ability to translate complex incident workflows into automated processes."} - {"name":"Cloud Infrastructure Security","description":"Practical knowledge of cloud infrastructure security including AWS, Azure, or GCP environments. Understanding of cloud-native security threats, container orchestration, identity and access management, and cloud logging and monitoring services."} - {"name":"Forensic Investigation Techniques","description":"Deep technical expertise in security incident investigation methodologies, threat hunting, artifact analysis, and evidence preservation. Ability to conduct root cause analysis, trace attacker activities through logs, and build comprehensive timelines of security events."} - {"name":"SOAR Platform Operations","description":"Experience with Security Orchestration, Automation and Response (SOAR) platforms for orchestrating multi-step incident response workflows. Knowledge of playbook design, API integration, and automated escalation procedures."} ### experience - {"name":"5+ Years Cybersecurity Domain Experience","description":"Minimum five years of professional experience working in cybersecurity roles, building expertise across threat detection, vulnerability management, security operations, or incident response functions. Demonstrated progression through increasingly complex security challenges and problem domains."} - {"name":"3+ Years Incident Management Leadership","description":"At least three years of hands-on experience serving as an Incident Manager or Incident Commander, taking full ownership of complex security investigations from initiation through resolution. Proven track record of leading investigations under pressure and delivering effective remediation."} - {"name":"Fintech or Financial Services Security Experience","description":"Preferred experience in fintech, banking, payments, or financial services security environments where regulatory compliance, customer data protection, and fraud prevention are critical. Understanding of financial threat models and controls required in regulated industries."} - {"name":"Enterprise Security Operations","description":"Background operating in large-scale enterprise Security Operations Center (SOC) environments or similar security teams. Experience managing incident queues, triaging alerts, and coordinating cross-functional security response efforts within complex organizational structures."} ## Skills ### required - {"name":"Incident Response Leadership","description":"Proven ability to lead security incident investigations, manage incident response teams during high-stress situations, provide clear direction to team members, and bring complex incidents to effective resolution."} - {"name":"Security Automation Engineering","description":"Proficiency developing security automation and response workflows using scripting languages, AI coding assistants, and SOAR platforms. Ability to identify opportunities where tooling can scale team capabilities and reduce manual toil."} - {"name":"Threat Detection and Analysis","description":"Deep expertise in identifying security signals within SIEM data, conducting threat analysis, performing root cause analysis, and developing detection rules. Strong pattern recognition skills and ability to think analytically about attacker methodologies."} - {"name":"Cross-Functional Collaboration","description":"Excellent communication and stakeholder management skills to coordinate incident response across Engineering, HR, Fraud, Privacy, and Leadership teams. Ability to translate technical findings into clear executive summaries and business-relevant impact assessments."} - {"name":"Problem-Solving Under Pressure","description":"Demonstrated ability to remain calm and make sound technical decisions during high-pressure incident response situations. Strong judgment in both technical problem-solving and cross-functional collaboration affecting millions of customers."} - {"name":"AI Coding Tool Proficiency","description":"Hands-on experience with modern AI coding assistants including Claude Code, Cursor, ChatGPT, and similar tools. Ability to leverage AI for productivity, security script development, and automation workflow design."} - {"name":"Workflow Process Design","description":"Ability to analyze complex, recurring security problems and break them into structured, repeatable steps suitable for tooling, automation, or AI-assisted handling. Thinking in workflows and process optimization."} ### preferred - {"name":"CISSP Certification","description":"Certified Information Systems Security Professional certification demonstrating comprehensive knowledge of information security and enterprise risk management principles."} - {"name":"Threat Intelligence Integration","description":"Experience integrating external threat intelligence feeds into SIEM systems, correlating threat intelligence with internal incidents, and using threat data to develop proactive detection rules."} - {"name":"Kubernetes and Container Security","description":"Familiarity with Kubernetes, Docker, and container orchestration security. Understanding of containerized application threats and runtime security controls relevant to modern infrastructure."} - {"name":"Mentoring and Team Development","description":"Prior experience mentoring junior security professionals, developing team capabilities, and fostering a culture of continuous learning within security teams. Track record of growing others in incident response craft."} - {"name":"Fintech Regulatory Compliance","description":"Knowledge of financial services regulatory requirements including PCI-DSS, SOC 2, PIPEDA, and other privacy/security regulations relevant to fintech platforms serving Canadian customers."} - {"name":"Fraud Investigation Experience","description":"Background investigating financial fraud, insider threats, or account compromise scenarios in fintech or financial services environments. Understanding of fraud patterns and investigation methodologies."} ## Tech stack ### tools - {"name":"SIEM Platforms (Splunk, Elastic Security, Sumo Logic)","description":"Core security monitoring and incident investigation tools for filtering alert noise, identifying true security signals, and conducting forensic investigations of suspicious activities."} - {"name":"SOAR Solutions (Cortex XSOAR, Phantom, Azure Sentinel)","description":"Security orchestration platforms for automating multi-step incident response workflows, integrating security tools, and enabling playbook-driven response procedures."} - {"name":"Endpoint Detection and Response (EDR)","description":"Tools like CrowdStrike Falcon, Microsoft Defender, or SentinelOne for deep visibility into endpoint activities, threat hunting, and rapid incident investigation across infrastructure."} - {"name":"Cloud Security Platforms (AWS Security Hub, Azure Sentinel, GCP Security Command Center)","description":"Cloud-native security monitoring and compliance tools for detecting threats within cloud environments, managing cloud access, and investigating cloud-based incidents."} - {"name":"Threat Intelligence Platforms","description":"Tools for consuming, correlating, and applying external threat intelligence feeds to improve detection rule quality and accelerate incident investigation."} - {"name":"AI Coding Assistants (Claude, Cursor, ChatGPT)","description":"Modern AI-powered development tools for rapid security script development, automation design, and productivity enhancement during security tool development."} - {"name":"Incident Management Platforms (PagerDuty, OpsGenie, Jira Service Management)","description":"Tools for managing incident lifecycle, on-call rotations, escalation procedures, and post-incident reviews following security events."} ### others - {"name":"Cloud Infrastructure (AWS, Azure, GCP)","description":"Practical operational knowledge of major cloud providers including compute, storage, networking, and managed services. Understanding of cloud-native threat models and security controls."} - {"name":"Container Orchestration (Kubernetes, Docker)","description":"Familiarity with containerized application deployment, orchestration, and security in modern cloud-native environments."} - {"name":"RESTful APIs and Webhooks","description":"Understanding of API design patterns, authentication mechanisms, and webhook integration for building custom security integrations and automation workflows."} - {"name":"Linux System Administration","description":"Strong command-line proficiency and operational Linux knowledge for incident investigation, log analysis, and security tool deployment across infrastructure."} ### databases - {"name":"Elasticsearch","description":"Central log storage and search engine used by many SIEM solutions for indexing, storing, and searching security events at massive scale."} - {"name":"Splunk","description":"Enterprise SIEM platform for log aggregation, analysis, and security event correlation. Foundational technology for detecting and investigating security incidents."} - {"name":"Time-Series Databases","description":"Specialized databases like InfluxDB or Prometheus for storing security metrics, alerting thresholds, and monitoring detection system performance over time."} ### languages - {"name":"Python","description":"Primary scripting language for incident response automation, data processing, and security tooling development. Used extensively for building custom security scripts and integrations."} - {"name":"Bash/Shell Scripting","description":"Essential for Linux system administration, log parsing, and lightweight automation tasks across Unix-based infrastructure and security operations."} - {"name":"SQL","description":"Query language for extracting and analyzing event data from SIEM databases, building security queries, and investigating security events across large log repositories."} - {"name":"Go or Rust","description":"Secondary languages for building performant security tools and automation utilities where speed and resource efficiency are critical for high-volume incident response."} ### frameworks - {"name":"SOAR Platform Frameworks","description":"Orchestration frameworks like Splunk Phantom, Palo Alto Networks Cortex XSOAR, or Demisto for building automated incident response playbooks and multi-tool orchestration."} - {"name":"FastAPI or Flask","description":"Python web frameworks for building incident response APIs, webhook handlers, and custom security dashboards that integrate with SIEM and security tooling."} - {"name":"Slack API Integration","description":"Framework for building Slack bots, incident notification systems, and interactive workflows that enhance security team collaboration during incident response."} ## Benefits ### benefits ## Compensation - **max:** 0 - **min:** 0 - **currency:** - **stockOptions:** false ## Interview process ### steps ## Full description ## **Build something people love** Wealthsimple is Canada’s leading financial innovator. The company offers a full suite of simple, sophisticated financial products across managed investing, do-it-yourself trading, cryptocurrency, tax filing, spending and saving. Wealthsimple currently serves more than 4 million Canadians and holds over $169 billion in assets under administration. The company was founded in 2014 by a team of financial experts and technology entrepreneurs, and is headquartered in Toronto, Canada. We're proud of what we've built β€” and we're just getting started. Read our [Culture Manual](https://www.wealthsimple.com/en-ca/culture) and learn more about [how we work](https://www.wealthsimple.com/en-ca/careers). ## **About the role** We are seeking an experienced and hands-on security professional to join our Detection & Response team as a Senior Incident Response Developer. Reporting to the Manager of Detection & Response, this is a critical, technical role focused on strengthening our ability to respond to and recover from security threats. You will be a key player in investigating complex security incidents, building scalable response processes, and taking command when it matters most. The ideal candidate has a deep, technical background in hands-on incident response and a keen eye for where automation can improve and scale our capabilities. You are a natural problem-solver who remains composed under pressure, a senior team member who enjoys mentoring others in the craft of incident response, and a builder who can create the playbooks, scripts, and processes needed to protect our company and our customers. Between incidents, you'll build the tooling and workflows that make the next one faster and easier to handle. ## **What you'll do** * Help take our security incident response capabilities to the next level by building relationships with Engineering teams, new playbooks and finding opportunities for automation. * Grow others in the art of Incident Response to support the program and increase consistency in outcomes. * Play a key role in building and shaping the Security Incident Response team. * Take the role of Incident Commander to bring incidents to resolution. * Turn recurring incident types into repeatable workflows (intake, playbook, automation, closure) so they become routine work for the team. * Help shape the direction of investment by informing the business of trends and relevant metrics. * Partner with our Security Engineers to monitor, refine, and expand our SIEM and SOAR platforms. * Coordinate with HR, Fraud and Privacy teams to investigate potential fraudulent and sensitive activity including insider threats and snooping. * Participate in an on-call rotation for responding to security incidents, internal questions and operational support. * Partner with the detection engineering function to develop new, high-fidelity detection rules based on incident trends and threat intelligence. ## **Skills you bring** * 5+ years of experience in the Cybersecurity domain. * 3+ years experience being an Incident Manager, taking ownership of investigations. * Ability to lead a team during high-stress situations, providing direction and support to team members. * Understand how to turn noise into signals using a SIEM. * Proficiency with AI coding (Claude Code, Cursor, ChatGPT etc). We invest in tooling (automation, Slack bots, AI agents) so responders spend their energy on the decisions that matter. * Thinks in workflows: can look at a messy, recurring problem and break it into steps that tooling or AI can take on. * Knowledge of and familiarity with cloud infrastructure. * Believes that honesty, transparency, and inclusivity are important when communicating with both internal and external stakeholders. * Demonstrates good judgment under pressure both in terms of technical problem solving and collaborating cross functionally. * Eager to learn from the team and others. We value making one another successful! ## **Why Wealthsimple?** 🌸 Top-tier health benefits and life insurance πŸ“ˆ Long-term group savings with employer match, through Wealthsimple for Business 🌴 20 vacation days, 4 wellness days, and unlimited sick and mental health days per year\* ✈️ 90 days away: work outside Canada for up to 90 days per year\* πŸ‘₯ Employee resource groups, including Rainbow (2SLGBTQ), Women of WS, and Black at WS 🌎 We are a hybrid team with over 1,500 employees across North America. The people are one of the best parts of working here: you'll collaborate with incredibly talented, curious, and driven teammates who are deeply committed to doing great work. \*Unlimited paid sick days, Wellness Days and the 90 day away program do not apply to certain roles. ## **ICYMI** **Technology & Innovation at Wealthsimple:** We move quickly and build thoughtfully. That means we're always looking for better ways to work β€” whether that's new tools, AI, or rethinking how we approach a problem. We don't expect you to have all the answers, but we do expect curiosity and a willingness to evolve alongside the products we're building. **Inclusion Statement:** We're building products for a diverse world, and we need a diverse team to do it well. We strongly encourage applications from everyone, regardless of race, religion, colour, national origin, gender, sexual orientation, age, marital status, or disability status. **Accessibility Statement:** We're committed to an accessible hiring experience. If you need any accommodations throughout the interview process, please let us know β€” we'll work with you to make sure you have what you need. We also welcome any feedback on how we can better accommodate candidates with accessibility needs. **AI in Hiring:** We may use artificial intelligence (AI) tools to support parts of our hiring process, such as reviewing applications, analyzing resumes, or assessing responses. These tools assist our team but don't replace human judgment – all final hiring decisions are made by people. If you have questions about how your data is used, reach out to us.