Security Incident Response Developer

Build something people loveWealthsimple is Canada’s leading financial innovator. The company offers a full suite of simple, sophisticated financial products across managed investing, do-it-yourself trading, cryptocurrency, tax filing, spending and saving. Wealthsimple currently serves more than 4 million Canadians and holds over $169 billion in assets under administration. The company was founded in 2014 by a team of financial experts and technology entrepreneurs, and is headquartered in Toronto, Canada.

We're proud of what we've built — and we're just getting started. Read our Culture Manual and learn more about how we work.

About the roleWe are looking for a curious, hands-on security professional early in their career to join our Detection & Response team as an Incident Response Developer. You’ll report to the Manager of Detection & Response and work closely with senior responders to investigate security incidents, improve our response processes and build automation that helps us scale. You’ll get hands-on experience with real incidents and the mentorship to grow into the craft.

The ideal candidate has a foundation in security fundamentals, some hands-on exposure to investigations or security operations, and real enthusiasm for automating repetitive work. You’re a problem-solver who stays calm when things get busy, asks good questions and wants to learn from experienced teammates.

What you'll do- Strengthen our incident response capabilities by building relationships with Engineering teams, writing new playbooks and automating manual steps.

• Own investigations from start to finish: triage, evidence collection, analysis, containment and documentation.

• Act as Incident Commander for low- and medium-severity incidents, and support senior responders on high-severity ones.

• Turn recurring incident types into repeatable workflows (intake, playbook, automation, closure), from the first design through to the tooling behind them.

• Report incident trends and metrics that inform team priorities.

• Work with our Security Engineers to monitor, refine and expand our SIEM and SOAR platforms.

• Work with the HR, Fraud and Privacy teams on investigations into potentially fraudulent and sensitive activity, including insider threats and snooping.

• Participate in an on-call rotation for responding to security incidents, internal questions and operational support.

• Work with the detection engineering team to develop new, high-fidelity detection rules based on incident trends and threat intelligence.

Skills you bring- 3+ years of experience in cybersecurity.

• 1–2+ years of hands-on incident response experience, owning investigations end to end.

• The ability to coordinate responders and stakeholders during an incident, and know when to escalate.

• Experience using a SIEM to turn noise into signal, including writing queries and tuning alerts.

• Proficiency with AI coding tools (Claude Code, Cursor, ChatGPT, etc.) to build and maintain automation. We invest in tooling (automation, Slack bots, AI agents) so responders spend their energy on the decisions that matter.

• A workflow mindset: you can look at a messy, recurring problem and break it into steps that tooling or AI can take on.

• Working knowledge of cloud infrastructure (e.g., AWS, GCP or Azure) and how to investigate within it.

• Discretion and sound judgment when handling sensitive information, such as HR and insider-threat matters.

• Clear, honest and inclusive communication with both internal and external stakeholders.

• Good judgment under pressure, in technical problem solving and in working across teams.

• A strong desire to learn from the team and others. We value making one another successful!

Why Wealthsimple?🌸 Top-tier health benefits and life insurance

📈 Long-term group savings with employer match, through Wealthsimple for Business

🌴...