IT Threat Operations & Detection Specialist

Dentons is designed to be different. Our Firm leads the way in a rapidly changing legal marketplace. We challenge the status quo and deliver consistent results as well as uncompromising quality and value to our clients. Our global presence is renowned as a firm with over 21,000 individuals in more than 200 offices serving clients across 80+ countries. Dentons Canada is committed to its people and communities. We are consistently recognized as an employer of choice having received numerous awards including being selected as one of Canada’s Top 100 Employers (2026); Canada’s Top Employers for Young People (2026), and Canada’s Best Diversity Employers (2026). This role is an opportunity for you to join Canada's Global Law Firm, a firm that offers opportunities to build your career while growing your skills and deepening your expertise. ROLE Dentons Canada LLP is currently recruiting for a Threat Operations & Detection Specialist who will be responsible for continuously improving threat detection, response readiness, and cyber resilience across the Canada technology environment. This role is not a traditional SOC (Security Operations Center) position. The candidate will govern the Managed Detection and Response (MDR) service, lead detection engineering, support incident response, perform threat hunting, and act as a technical escalation and backup for operational security requests when required. KEY RESPONSIBILITIES & ACCOUNTABILITIES MDR Governance & Detection Engineering Govern the MDR service to ensure high-quality monitoring, escalation, investigation support, reporting, and continuous improvement. Develop, tune, and maintain high-fidelity detection use cases across Microsoft Sentinel, Defender XDR, identity, endpoint, cloud, email, and network telemetry. Improve detection coverage using MITRE ATT&CK, threat intelligence, incident learnings, audit findings, and identified control gaps. Work with the MDR provider to reduce false positives, validate alerts, improve escalation quality, and ensure meaningful visibility into priority threats. Support log source onboarding, detection coverage assessments, analytics development, dashboarding, and operational reporting. Develop and maintain detection logic, response playbooks, and automation workflows that improve mean time to detect and contain security events. Threat Hunting, Incident Response & Technical Investigation Conduct proactive threat hunting using SIEM, EDR/XDR, identity, cloud, email, network, and other relevant telemetry sources. Triage, investigate, and respond to escalated security alerts, incidents, and suspected compromise activity in partnership with the MDR provider and internal teams. Act as a technical responder for phishing, malware, account compromise, endpoint compromise, insider threat, suspicious access, and cloud security events. Support containment, eradication, recovery, forensic evidence collection, incident timelines, and post-incident reviews. Translate incident findings into improved detections, response procedures, preventive controls, and security awareness actions. Participate in incident tabletop exercises, purple team exercises, and response readiness activities. Threat Intelligence, Emerging Threats & Continuous Improvement Monitor emerging threats relevant to professional services and legal environments, including identity compromise, ransomware, supply chain attacks, cloud abuse, API abuse, data theft, and AI-enabled phishing. Convert threat intelligence into practical detection use cases, hunting hypotheses, playbook improvements, and preventive recommendations. Produce operational threat reports, detection coverage summaries, incident trends, and metrics for Security leadership and stakeholders. Collaborate with the Information Security Design Specialist and Cloud & Vulnerability Specialist to ensure threat intelligence informs architecture, configuration, and exposure reduction priorities. Identify opportunities for SOAR, …

View the full posting and apply