Director, Security Operations & Detection Engineering

Job description

Job responsibilities

• Own end-to-end leadership of the D&R and SOC teams, including engineers and analysts across detection engineering, incident response, and 24x7 monitoring/triage.
• Own 24x7 staffing model, on-call rotations, and resource allocation across time zones to ensure continuous coverage; participate in leadership escalation on-call as needed.
• Define and drive the multi-year strategy and roadmap for detection engineering, threat hunting, incident response, and security operations.
• Stay close enough to the technology (SIEM, EDR, NDR, SOAR, cloud-native and vehicle/embedded environments) to make architecture and prioritization calls, review technical strategy with your leads, and step in on the…
• Own end-to-end incident response posture - from detection through containment, eradication, recovery, and post-incident reviews. Serve as the executive point of contact for cybersecurity incidents and audits.
• Oversee cloud vulnerability management: ensure findings are triaged by severity/exploitability, owners are assigned, and remediation or compensating controls are tracked to closure against SLAs.
• Oversee design, development, and implementation of detections, tooling and Cross Functional projects that touch Cloud, Enterprise, and On-Vehicle D&R/SOC.
• Own and report on KPIs, telemetry coverage, alert fidelity, and SOC efficiency and maturity to executive leadership.

Job requirements

• 15+ years of progressive cybersecurity experience, including 6+ years leading, managing, and scaling detection engineering and security operations teams.
• Current hands-on experience with detection engineering, threat hunting, or incident response sufficient to credibly guide technical strategy and support your team.
• Strong working knowledge of SIEM, EDR, NDR/SOAR, and modern detection and response tooling. Strong understanding of cloud-native environments (AWS, Kubernetes) and enterprise/endpoint security (Linux, macOS, Windows).
• Deep knowledge of the MITRE ATT&CK framework, NIST CSF, and modern adversarial techniques.
• End-to-end incident management experience, driving cross-departmental collaboration through high-severity incidents.
• Experience with vulnerability management, including triage/prioritization of findings and driving remediation across engineering teams.
• Demonstrated experience building a metrics/reporting program from scratch (defining metrics, implementing measurement, and coaching a team to deliver insight rather than raw data) for a technical function.
• Working proficiency in Python and/or C++.