Cyber Use Case Developer

Sun Life

Cyber Use Case Developer designing and developing security monitoring use cases to detect cyber threats at Sun Life. Collaborating with teams to translate risks into actionable detection logic.

Posted 7/27/2026full-timeToronto • 🇨🇦 CanadaMid-LevelSenior💰 CA$65,000 - CA$105,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in security operations and detection engineering, with a strong ability to develop detection logic and analyze security data to identify threats. Proficient in using SIEM, EDR, and various programming languages to enhance security monitoring and incident response.

Highest-signal resume keywords

Security OperationsDetection EngineeringSIEM ExperienceDetection Logic DevelopmentCyber Threat Intelligence

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Detection LogicSPLKQLSQLSigmaYARAPythonPowerShellThreat HuntingIncident Response

Soft Skills

DocumentationCommunicationStakeholder Management

Tools & Technologies

SIEMEDRXDRCloud SecurityNetwork TelemetryEndpoint Telemetry

Industry Keywords

Cyber SecurityMITRE ATT&CKCyber Kill ChainNISTCIS Controls

Tech Stack

Tools & technologies

CloudCyber SecurityPythonSQL

About the role

Key responsibilities & impact

Design, develop, test, and continuously improve security monitoring use cases that detect suspicious activity, policy violations, and potential cyber threats
Work closely with Security Operations, Threat Hunting, Cyber Threat Intelligence, Incident Response, and various teams to translate threat behaviours, business risks, and operational requirements into actionable detection logic and high-quality alerts
Strengthen the organization’s ability to identify threats early, reduce false positives, improve alert fidelity, and support timely investigation and response

Requirements

What you’ll need

Post-secondary education in Cyber Security, Information Technology, Computer Science, Information Systems, or related field, or equivalent practical experience
Experience in security operations, detection engineering, threat hunting, incident response, cyber threat intelligence, or related cyber security function
Hands-on experience working with SIEM, EDR, XDR, cloud security, identity, network, or endpoint telemetry
Experience writing detection logic or search queries using languages such as SPL, KQL, SQL, Sigma, YARA, Python, PowerShell, or similar
Strong understanding of common attacker behaviours, malware techniques, persistence methods, lateral movement, credential abuse, phishing, data exfiltration, and cloud or identity-based attacks
Familiarity with security frameworks and methodologies such as MITRE ATT&CK, Cyber Kill Chain, NIST, CIS Controls, or similar
Ability to analyze large volumes of security data and identify patterns, anomalies, and actionable findings
Strong documentation, communication, and stakeholder management skills.

Benefits

Comp & perks

Diversity and inclusion initiatives
Flexible work arrangements
Supportive work environment