Incident Response Developer Automation

Build incident response automation at Wealthsimple using SIEM, SOAR, and AI coding tools within a hybrid Detection & Response team. Investigate real security incidents while developing repeatable workflows for scale.

As an Incident Response Developer, you will work with senior responders and the Manager of Detection & Response. The work combines investigations, automation, playbook development, and incident metrics. You will also collaborate with Engineering, Security Engineering, and detection engineering teams to strengthen response capabilities. This early-career role provides hands-on exposure to incident response and mentorship while supporting sensitive investigations with HR, Fraud, and Privacy.

Key Responsibilities:

• Build playbooks and automate manual incident response steps
• Own triage, evidence collection, analysis, containment, and documentation
• Coordinate low- and medium-severity incidents as Incident Commander
• Develop repeatable workflows from intake through closure
• Refine SIEM, SOAR, and detection capabilities

Requirements:

• Three or more years of cybersecurity experience
• One to two or more years owning incident investigations
• Experience writing SIEM queries and tuning alerts
• Proficiency with Claude Code, Cursor, ChatGPT, or similar tools
• Working knowledge of AWS, GCP, or Azure investigations

Apply incident response, SIEM expertise, cloud investigation, and automation skills to help Wealthsimple scale security operations.