Senior Cyber Use Case Developer

You are as unique as your background, experience and point of view. Here, you’ll be encouraged, empowered and challenged to be your best self. You'll work with dynamic colleagues - experts in their fields - who are eager to share their knowledge with you. Your leaders will inspire and help you reach your potential and soar to new heights. Every day, you'll have new and exciting opportunities to make life brighter for our Clients - who are at the heart of everything we do. At Sun Life, we're driven by our Purpose: helping our Clients achieve lifetime financial security and live healthier lives. Our values shape how we work: caring, authentic, bold, inspiring, and impactful. When you join Sun Life, you'll work with passionate colleagues and empowering leaders who support your growth and celebrate your contributions, so you can make a meaningful difference in our Clients' lives. Discover how you can make a difference in the lives of individuals, families and communities around the world. Job Description: Job description The Senior Cyber Use Case Developer is responsible for leading the design, development, testing, and continuously improvement of advanced security monitoring use cases that detect suspicious activity, policy violations, and potential cyber threats across complex enterprise environments. This role provides subject matter expertise in detection engineering, threat-informed defense, telemetry analysis, and alert optimization, translating adversary behaviors, business risks, and operational requirements into actionable, high-fidelity detection logic. The senior developer acts as a technical lead and trusted advisor for various teams, including Security Operations, Cyber Threat Hunting, Cyber Threat Intelligence, Incident Response. The role helps mature the organization’s detection capability by improving coverage of priority threats, reducing false positives, standardizing use case lifecycle practices, and ensuring detections remain effective as threats, technologies, and business priorities evolve. Qualifications Post-secondary education in Cyber Security, Information Technology, Computer Science, Information Systems, Engineering, or a related field, or equivalent practical experience. 5 or more years of experience in security operations, detection engineering, threat hunting, incident response, cyber threat intelligence, security engineering, or a related cyber security function. Relevant certifications such as CompTIA CySA+, GIAC GCIH, GCIA, GCTI, GCDA, GCFA, CISSP, Microsoft Security certifications, Splunk certifications, cloud security certifications, or MITRE ATT&CK Defender. Demonstrated experience leading or materially contributing to detection use case development, SIEM content engineering, alert tuning, and use case lifecycle management in an enterprise environment. Advanced hands-on experience working with SIEM, EDR, XDR, cloud security, identity, network, endpoint, and application telemetry. Strong proficiency writing detection logic or search queries using languages such as SPL, KQL, SQL, Sigma, YARA, Python, PowerShell, regular expressions, or similar. Deep understanding of attacker behaviours, malware techniques, persistence, privilege escalation, lateral movement, credential abuse, phishing, data exfiltration, cloud compromise, and identity-based attacks. Strong working knowledge of security frameworks and methodologies such as MITRE ATT&CK, Cyber Kill Chain, NIST, CIS Controls, detection engineering frameworks, and threat-informed defence practices. Experience analyzing complex security telemetry and incident data to identify detection gaps, define requirements, and produce actionable findings. Ability to lead technical discussions, influence stakeholders, mentor peers, and communicate detection strategy clearly to technical and non-technical audiences. Strong documentation, quality assurance, prioritization, and stakeholder management skills. Responsibilities Lead the development, enhancement, and li