Senior Logging & Detection Engineer

Clio is the global leader in legal AI technology, empowering legal professionals and law firms of every size to work smarter, faster, and more securely.

We are currently seeking a Senior Logging & Detection Engineer to lead the technical direction within our rapidly growing Security team and our new Logging Engineering team. This role is for a seasoned professional passionate about building sophisticated, scalable detection architectures, mastering efficient queries at petabyte scale, and driving strategic security analytics through log data. You will own the detection and analysis layer of our logging platform, serving as the domain expert who makes a tangible, high‑impact difference to our security monitoring capabilities.

This role is available to candidates across Canada (excluding Quebec). If you are local to one of our hubs (Burnaby, Calgary, or Toronto) you will be expected to be in office minimum two days per week for our Anchor Days.

We are looking for the right candidate to develop, optimize, and serve as the technical lead for our security detection capabilities, and be the technical expert in query optimization and analytics. If you have a deep background in security analytics and senior level experience in platform‑level log analysis and detection engineering, then we want to talk to you.

• Lead the design and implementation of sophisticated, production‑ready detection rules and queries across the ELK stack, security data lakes, and multi‑cloud logging platforms.
• Architect and optimize complex search queries, aggregations, and analytics dashboards for high‑velocity security monitoring, focusing on performance and cost efficiency.
• Design and build automated detection and response workflows (SOAR), ensuring seamless and reliable integration with critical incident response systems.
• Serve as the primary liaison with the threat intelligence team, developing and owning the framework to translate intelligence into scalable, actionable detection capabilities (e.g., MITRE ATT&CK coverage).
• Establish and maintain a robust detection rule library, query templates, and lead the creation of security analytics playbooks for the wider team.
• Drive performance optimization and resource utilizationabyte‑scale log datasets, including index design and data tiering.
• Develop and standardize custom visualizations, dashboards, and executive reporting capabilities for security stakeholders.
• Lead complex threat hunting operations, mentor junior team members on investigative techniques, and proactively refine detection logic to achieve near‑zero false positive rates.
• Collaborate closely with the platform team to define the logging architecture roadmap based on future detection requirements and security observability goals.
• Proactively research emerging threats and attack patterns, translating novel techniques into strategic, forward‑looking detection logic and advising security leadership.

• Senior‑level expertise building and scaling enterprise‑grade detection capabilities and security monitoring systems.
• Expert‑level query language proficiency in Elasticsearch/Lucene, SQL, KQL (Kusto), or SPL (Splunk), demonstrating advanced optimization techniques.
• Extensive Detection Engineering experience owning the full lifecycle of rules, alerts, and automated response workflows within a SIEM/SOAR environment.
• Advanced log analysis skills across diverse, large‑scale data sources, including multi‑cloud logs (AWS, Azure, GCP), network flows, and advanced security tool outputs.
• Deep dashboard and visualization expertise with Kibana, Grafana, or Tableau for security metrics and executive reporting.
• Proven expertise in leading threat hunting efforts using log data to proactively identify and track sophisticated threats and anomalous behavior across the environment.
• Senior‑level scripting and automation abilities (Python/Go/Power Shell) for building custom tools, managing APIs, and driving detection automation at scale.
• Architectural experience integrating and optimizing SIEM platforms, SOAR tools, and security orchestration systems.
• Expert performance optimization skills covering query…