Sr Security Operations Engineer, Detection and Response

Senior Security Operations Engineer, Detection and Response at Fortis Games

Fortis Games is seeking a Senior Security Operations Engineer, Detection and Response to help build and mature our security operations capabilities. This is a senior, hands-on engineering role based in Canada or the UK, designed for a professional who can translate attacker behavior, telemetry, and operational risk into reliable detections and response workflows. As an early-stage organization led by game industry veterans, we are looking for someone with a builder mindset who enjoys ownership and wants to create practical security capabilities in a moving environment.

In this position, you will own the systems used to detect, investigate, and respond to threats across our corporate, cloud, identity, endpoint, and game development environments. While this is primarily an engineering role, you should be prepared to dedicate approximately 20% of your time to governance, risk, and compliance (GRC) activities, such as audit readiness, control evidence, and policy documentation.

Key Responsibilities

• Design, implement, and tune detections across endpoint, identity, cloud, SaaS, network, and application telemetry.
• Build detection-as-code practices using version control, peer review, and repeatable deployment methods.
• Improve SIEM and security telemetry pipelines, including log ingestion, correlation logic, and alert routing.
• Design and operate practical deception capabilities like canary tokens and decoy accounts.
• Lead incident response investigations, including severity triage and remediation efforts.
• Collaborate with IT, infrastructure, and game development teams to improve security visibility.
• Participate in a weekend-inclusive schedule to support continuous security operations coverage.

Requirements

To be successful in this role, you must hold a Bachelor’s degree and have 6+ years of experience in security operations, detection engineering, or incident response. You should have strong experience writing and maintaining detections in SIEM or EDR environments, such as CrowdStrike Falcon. We require practical AWS security knowledge (including IAM, CloudTrail, and GuardDuty) and the ability to automate security workflows using tools like Python, Bash, PowerShell, or SQL. Proficiency in managing audit evidence and technical control documentation is also necessary.