Cyber Use Case Developer - Sun Life

You are as unique as your background, experience and point of view. Here, you’ll be encouraged, empowered and challenged to be your best self. You'll work with dynamic colleagues - experts in their fields - who are eager to share their knowledge with you. Your leaders will inspire and help you reach your potential and soar to new heights. Every day, you'll have new and exciting opportunities to make life brighter for our Clients - who are at the heart of everything we do.

At Sun Life, we're driven by our Purpose: helping our Clients achieve lifetime financial security and live healthier lives. Our values shape how we work: caring, authentic, bold, inspiring, and impactful.

When you join Sun Life, you'll work with passionate colleagues and empowering leaders who support your growth and celebrate your contributions, so you can make a meaningful difference in our Clients' lives.

Discover how you can make a difference in the lives of individuals, families and communities around the world.

Job Description:

The Cyber Use Case Developer is responsible for designing, developing, testing, and continuously improving security monitoring use cases that detect suspicious activity, policy violations, and potential cyber threats across enterprise environments. This role works closely with Security Operations, Threat Hunting, Cyber Threat Intelligence, Incident Response, and various teams to translate threat behaviours, business risks, and operational requirements into actionable detection logic and high-quality alerts. The analyst plays a key role in strengthening the organization’s ability to identify threats early, reduce false positives, improve alert fidelity, and support timely investigation and response.

Qualifications

• Post-secondary education in Cyber Security, Information Technology, Computer Science, Information Systems, or a related field, or equivalent practical experience.
• Experience in security operations, detection engineering, threat hunting, incident response, cyber threat intelligence, or a related cyber security function.
• Hands-on experience working with SIEM, EDR, XDR, cloud security, identity, network, or endpoint telemetry.
• Experience writing detection logic or search queries using languages such as SPL, KQL, SQL, Sigma, YARA, Python, PowerShell, or similar.
• Strong understanding of common attacker behaviours, malware techniques, persistence methods, lateral movement, credential abuse, phishing, data exfiltration, and cloud or identity-based attacks.
• Familiarity with security frameworks and methodologies such as MITRE ATT&CK, Cyber Kill Chain, NIST, CIS Controls, or similar.
• Ability to analyze large volumes of security data and identify patterns, anomalies, and actionable findings.
• Strong documentation, communication, and stakeholder management skills.

Responsibilities