Senior Manager, JSOC & Threat Hunting

Questrade is on a mission to help Canadians to become much more financially successful and secure.

For nearly 30 years, Questrade Financial Group has been delivering on that mission through investing, banking, mortgages, and real estate. Together, we tilt finance in favour of ambitious Canadians, creating new ways for them to seize the financial future they deserve.

We're looking for people who are ready to enter their career inflection point. Mission-driven, exceptional folks that never settle. The work here is hard because the responsibility is real. If that's the standard you've been looking for, keep reading.

Req #4265

The return on your career investment

• Compensation and incentives built to reward the value you bring.
• RRSP matching of up to 6%.
• Health and wellness resources and programs, including $5,000 in mental health practitioner coverage.
• $5,000 in tuition subsidies for job-related courses, every year.
• 100% parental top-up, up to 26 weeks for birthing parents and 18 weeks for non-birthing parents.
• A hybrid environment, with at least three days in the office built for working together.
• Paid vacation, personal, and sick days.
• A community care day to give back to the causes you care about.

This job posting is for an existing vacancy.

We’re looking for our next Senior Manager, JSOC & Threat Hunting

The Senior Manager, JSOC & Threat Hunting is a hands-on technical leader accountable for security monitoring, incident response, threat hunting and intelligence, detection and security engineering, vulnerability management and DevSecOps across Questrade Financial Group's regulated entities. She/he leads the Joint Security Operations Centre (JSOC) as a 24x7, multi-shift operation spanning three teams (SOC and Incident Response, Threat Operations and Engineering, and DevSecOps), owns the JSOC service catalogue, and remains directly involved in major incidents, complex investigations, detection design, SIEM optimization and security tooling decisions. This is not a coordination-only leadership role. The role operates in a dual regulatory environment covering CIRO regulated dealer and wealth entities and OSFI regulated federal financial institutions, and is the senior escalation point for cyber incident detection, containment and the incident inputs required for regulator reporting.

The mandate

In this role, you will:

• Lead the Joint Security Operations Centre as a highly technical, hands-on leader across three teams: SOC and Incident Response, Threat Operations and Engineering, and DevSecOps. Remain directly involved in complex investigations, high-severity incidents, detection design, SIEM optimization and security tooling decisions, and challenge technical assumptions rather than rely on tool-generated conclusions.
• Own and maintain the JSOC service catalogue across three service lines (SOC/IR, Threat Operations, and DevSecOps), with defined service levels, a named owner and a named backup for every service line.
• Run alert monitoring and response as a continuous, multi-shift operation across five countries, ensuring coverage, shift handover discipline and consistent investigation quality across regions and time zones.
• Own the incident management lifecycle end to end, including severity classification, escalation paths, playbooks, evidence handling and chain of custody, containment, remediation, recovery and lessons learned. Provide technical direction from triage through closure on major incidents and lead cross-functional coordination with engineering, infrastructure, cloud, identity, fraud, privacy, legal and business teams.
• Ensure incident detection, classification and evidence are sufficient to meet OSFI technology and cyber security incident reporting expectations, including the 24-hour initial notification, and CIRO cybersecurity incident reporting obligations. Label every incident to the correct entity and regime and provide timely, accurate inputs to the Global Security Office, Legal, Privacy and Compliance.
• Oversee the design, testing, tuning and lifecycle management of detection rules and alerts mapped to MITRE ATT&CK. Improve SIEM effectiveness by reducing noise and false positives, optimising queries and ensuring alerts are actionable, and maintain a measured view of detection coverage and known gaps.
• Develop and run a proactive threat hunting program covering employee-facing and client-facing threats, informed by threat intelligence, attacker behaviours, environmental risk and observed detection gaps. Convert hunt findings into durable detections and control improvements.
• Own CTI tooling configuration, alert set-up, monitoring and response, and feed intelligence into detection, hunting, vulnerability prioritisation and fraud use cases.
• Own enterprise vulnerability management and external attack surface management, including EASM configuration and inventory, prioritisation by exploitability and entity exposure, and remediation tracking with named owners and committed dates in partnership with technology owners.
• Provide technical leadership for Elastic Security, including log source onboarding, parsing and configuration, data ingestion, query development, dashboards, detection rules, integrations and platform optimisation. Ensure logging and telemetry across applications, APIs, endpoints, identity systems, networks, cloud platforms and third-party services provide the visibility required to detect and investigate activity.
• Own deployment, administration and lifecycle management of JSOC security solutions, including Zscaler (ZIA, ZPA, ZDX) and email security, and evaluate and improve tools, integrations and workflows on measurable operational value.
• Direct security and fraud research and development within the JSOC, including AI-assisted triage and automation, in line with enterprise AI governance requirements. Apply change control and independent review before any internally built tooling enters production, maintaining segregation between building a control and monitoring it.
• Lead the DevSecOps team in SAST and DAST configuration, application vulnerability management and application security advisory, prioritised by regulated-entity exposure. Partner with engineering and platform teams to integrate security controls and testing into CI/CD pipelines, investigate application-layer threats and strengthen detection across the software development lifecycle.
• Support integrity investigations for Compliance, HR, Fraud and Legal under evidence-handling standards, and partner with Enterprise Fraud on account takeover, abuse and fraud-adjacent detection and response affecting online financial services.
• Define and monitor operational metrics including detection coverage, alert quality, time to detect and respond, investigation outcomes, recurring incident patterns and control gaps, and prepare quarterly executive and Board committee reporting content for the Global Security Office.
• Participate in and facilitate incident simulations, technical tabletop exercises and post-incident reviews, ensuring lessons result in concrete improvements to controls, detections and response procedures.
• Hire, coach, develop and manage the JSOC leadership layer and, through them, the wider team. Raise the team's technical depth, set clear expectations for investigation quality and operational ownership, and manage span of control, shift staffing and succession so that no service line depends on a single person.
• Partner with Cyber Strategy, Risk and GRC, Offensive Security, Identity and Access Management, Enterprise Fraud, Enterprise Architecture, Cloud and Infrastructure, Privacy, Legal, Internal Audit and entity compliance officers. Provide evidence for SOC 2, ISO 27001, NIST CSF and regulator reviews covering detection and response controls.
• Review complex technical findings and communicate business impact, evidence and recommended actions clearly to technical and non-technical stakeholders, including executive and Board committee audiences.
• Stay current with attacker techniques, application security risks, security operations practices, cloud-native security operations and technologies relevant to a Canadian regulated financial group.

You’re ready for this mandate if you have the following qualifications

• 10+ years of relevant cybersecurity experience, including substantial experience in security operations, incident response, detection engineering or threat hunting, with 5+ years leading technical security professionals and at least 2 years leading managers or team leads.
• Strong hands-on incident response experience, including investigation, scoping, containment, remediation, recovery and post-incident analysis, with major incident leadership in a regulated financial services environment.
• Demonstrated experience running a 24x7 or follow-the-sun security operations function across multiple countries and shifts.
• Demonstrated experience conducting threat hunts and converting findings into durable detections or security improvements.
• Deep knowledge of SIEM operations, including alert development, query optimisation, data onboarding, false-positive reduction and detection coverage measurement.
• Strong practical experience with Elastic Security, Elasticsearch, Kibana, Elastic Query Language (EQL) and Kibana Query Language (KQL), or equivalent query and detection capabilities.
• Solid understanding of application security concepts, including common web and API attack techniques, secure development practices, vulnerability management and application-layer telemetry.
• Strong knowledge of endpoint, network, identity, cloud and application security data sources, and the ability to analyse logs, network activity, authentication events, endpoint telemetry and application behaviour without relying solely on tool-generated conclusions.
• Experience with MITRE ATT&CK and the Cyber Kill Chain, and with developing security automation, scripts, integrations or repeatable investigation workflows.
• Strong written and verbal communication skills, with the ability to explain technical risk clearly, make sound decisions in high-pressure situations and present to executive and Board committee audiences.
• A leadership style grounded in technical credibility, accountability, collaboration and continuous improvement, with proven ability to build a leadership layer and manage span of control across a geographically distributed team.
• Experience in a regulated financial services environment such as banking, brokerage, wealth management, payments or fintech.
• CISSP, GCIH, GCIA, GCFA, GNFA, OSED, CPTS, Security+ or equivalent practical experience.
• Familiarity with OSFI B-13, B-10 and E-21, OSFI technology and cyber security incident reporting expectations and CIRO cybersecurity incident reporting obligations, or demonstrated ability to learn a new prudential regime quickly.
• Deep expertise with Zscaler products, including ZIA, ZPA, ZDX and related integrations and telemetry.
• Familiarity with CrowdStrike Falcon, Wiz, Aikido and cloud-native security operations in Google Cloud Platform or another major cloud provider.
• Experience integrating security controls and testing into CI/CD pipelines, and familiarity with SOAR platforms and AI-assisted triage and automation workflows.
• Experience investigating fraud, account takeover, abuse or other threats affecting online financial services.
• Experience with scripting or development in Python, JavaScript, Bash or another relevant language.

Additional Information

• Lead a globally distributed team operating a follow-the-sun model across Canada, Brazil, Armenia, Israel and Argentina, with shift-based SOC coverage (Shifts A, B and C) and flexible Eastern Time coverage.
• Working day anchored to the Toronto Eastern Time business day for executive, entity, auditor and regulator-facing engagement.
• Available for major incident escalation outside business hours, with a named deputy arrangement in place for planned absences so that incident command never depends on a single person.

Enter your career inflection point. Apply now.

#LI-NP1

#LI-Hybrid

The final compensation package will be commensurate with the successful candidate's experience, skills, and geographic location (Canada). It includes a comprehensive benefits plan and a competitive incentive (bonus) program for Full-Time Permanent roles.

Base salary range

$170,000—$185,000 CAD

Technology and AI

We mix human ingenuity with advanced technology. For ambitious builders like you, we provide the latest technology to enable your creativity. You'll have everything you need to build the best outcomes and products for our clients.

Diversity and Inclusion

At Questrade Financial Group of Companies, we’re committed to fostering a diverse, inclusive, and accessible work environment where individuals are treated with dignity and respect. Our global team reflects the diversity of the communities we serve and operate in.

Accessibility statement

Candidates selected for an interview are contacted directly. If you require accommodation during the recruitment or selection process, please let us know. We will work with you to meet your needs.

AI in hiring

Questrade Financial Group of companies Applicant Tracking System uses artificial intelligence (AI) for application screening. The AI system operates on predetermined criteria, with final decisions subject to human review.