Senior Logging & Detection Engineer, Clio

• Are you someone who's always probing and asking why at an architectural level, someone who enjoys finding system-wide patterns in data and designing smarter, fault-tolerant detection logic?
• If so, we have a strategic spot for you on Clio's new Logging Engineering team
• If you have a deep background in security analytics and senior level experience in platform-level log analysis and detection engineering, then we want to talk to you
• Senior-level expertise building and scaling enterprise-grade detection capabilities and security monitoring systems
• Expert-level query language proficiency in at least two of the following: Elasticsearch/Lucene, SQL, KQL (Kusto), or SPL (Splunk), demonstrating advanced optimization techniques
• Extensive Detection Engineering experience owning the full lifecycle of rules, alerts, and automated response workflows within a SIEM/SOAR environment
• Advanced log analysis skills across diverse, large-scale data sources, including multi-cloud logs (AWS, Azure, GCP), network flows, and advanced security tool outputs
• Deep dashboard and visualization expertise with tools like Kibana, Grafana, or Tableau, specifically for security metrics and executive reporting
• Proven expertise in leading threat hunting efforts using log data to proactively identify and track sophisticated threats and anomalous behavior across the environment
• Senior-level scripting and automation abilities (Python/Go/PowerShell), used to build custom tools, manage APIs, and drive detection automation at scale
• Architectural experience integrating and optimizing SIEM platforms, SOAR tools, and security orchestration systems
• Expert performance optimization skills covering query tuning, index design, data partitioning, and overall resource-efficient analytics on big data
• Significant incident response experience providing expert-level technical analysis and forensic support during major security incidents
• Demonstrate a keen interest in improving your craft by using AI
• Multi-platform security architecture experience across major cloud environments (AWS CloudTrail, Azure Activity Logs, GCP Audit Logs)

Desirable

• We are currently seeking a Senior Logging & Detection Engineer to lead the technical direction within our rapidly growing Security team and our new Logging Engineering team
• This role is for a seasoned professional passionate about building sophisticated, scalable detection architectures, mastering efficient queries at petabyte scale, and driving strategic security analytics through log data
• You will own the detection and analysis layer of our logging platform, serving as the domain expert who makes a tangible, high-impact difference to our security monitoring capabilities
• This role is available to candidates across Canada (excluding Quebec)
• If you are local to one of our hubs (Burnaby, Calgary, or Toronto) you will be expected to be in office minimum two days per week for our Anchor Days
• We are looking for the right candidate to develop, optimize, and serve as the technical lead for our security detection capabilities, and be the technical expert in query optimization and analytics
• Lead the design and implementation of sophisticated, production-ready detection rules and queries across the ELK stack, security data lakes, and multi-cloud logging platforms
• Architect and optimize complex search queries, aggregations, and analytics dashboards for high-velocity security monitoring, focusing on performance and cost efficiency
• Design and build automated detection and response workflows (SOAR), ensuring seamless and reliable integration with critical incident response systems
• Serve as the primary liaison with the threat intelligence team, developing and owning the framework to translate intelligence into scalable, actionable detection capabilities (e.g., MITRE ATT&CK coverage)
• Establish and maintain a robust detection rule library, query templates, and lead the creation of security analytics playbooks for the wider team
• Drive performance optimization and resource utilization strategies across petabyte-scale log datasets, including index design and data tiering
• Develop and standardize custom visualizations, dashboards, and executive reporting capabilities for security stakeholders
• Lead complex threat hunting operations, mentor junior team members on investigative techniques, and proactively refine detection logic to achieve near-zero false positive rates
• Collaborate closely with the platform team to define the logging architecture roadmap based on future detection requirements and security observability goals
• Proactively research emerging threats and attack patterns, translating novel techniques into strategic, forward-looking detection logic and advising security leadership