Cybersecurity Detection Engineer – Purple Team

About the role

Act Digital is seeking a Cybersecurity Detection Engineer to strengthen the defensive capabilities of a major financial‑sector client in Montreal. The role blends detection engineering, purple‑team activities and offensive validation to ensure that security detections are effective against real‑world attacker techniques.

Key responsibilities

• Review, tune and expand existing detection use cases across endpoint, identity, network and cloud layers.
• Design and implement new detection logic and behavioral analytics based on MITRE ATT&CK.
• Validate detections through adversary simulations, red‑team exercises and threat‑actor emulation.
• Identify gaps in coverage and work with SOC, Incident Response and Security Engineering teams to close them.
• Reduce false positives and improve overall detection quality.

Required profile

• Minimum 3 years of experience in cybersecurity, preferably in detection engineering, SOC or purple‑team roles.
• Hands‑on experience with offensive security techniques or adversary simulation.
• Background working in enterprise or regulated environments, such as finance.
• Strong analytical and investigative abilities.

Required skills

• SIEM and EDR platforms.
• Detection use‑case development and tuning.
• MITRE ATT&CK framework.
• Log analysis and event correlation.
• Scripting in Python, PowerShell or Bash.
• Windows security and Active Directory knowledge.