{"id":2985638,"url":"https://alion.io/job/aurora-director-security-operations-detection-engineering","title":"Director, Security Operations & Detection Engineering","company":{"id":40481,"name":"Aurora Innovation","domain":"aurora.tech","url":"https://alion.io/company/aurora-tech","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"head","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mountain View, United States","Pittsburgh, United States","Seattle, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":247000,"max":396000,"currency":"USD","period":"year","gross":null,"usd_annual":396000},"salary_estimate":null,"experience_years_min":15,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Amazon Aurora","optional":false},{"name":"AWS","optional":false},{"name":"C++","optional":false},{"name":"CI/CD","optional":false},{"name":"eBPF","optional":false},{"name":"Git","optional":false},{"name":"Incident Management","optional":false},{"name":"Kubernetes","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST CSF","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Snowflake","optional":false},{"name":"SQL","optional":false},{"name":"Sysmon","optional":false},{"name":"Terraform","optional":false},{"name":"Windows","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-10-05T17:05:42Z","employer_posted_date":"2026-10-05","last_verified_at":"2026-10-26T01:05:08Z","board_verified":true,"closed_at":null,"days_open":20,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":20},"description":"Who we are\nAurora’s mission is to deliver the benefits of self-driving technology safely, quickly, and broadly.\nThe Aurora Driver will create a new era in mobility and logistics, one that will bring a safer, more efficient, and more accessible future to everyone.\nAt Aurora, you will tackle massively complex problems alongside other passionate, intelligent individuals, growing as an expert while expanding your knowledge. For the latest news from Aurora, visit aurora.tech or follow us on LinkedIn.\nWhat we are looking for\nWe are searching for a Director of Security Operations & Detection Engineering to lead and unify Aurora’s Detection & Response (D&R) and Security Operations Center (SOC) functions under our Technical Assurance division. This role owns the strategy, roadmap, and operating rigor for how Aurora detects, triages, investigates, and responds to threats across Onboard (vehicle), Cloud, and Enterprise environments - spanning both the engineering that builds our detection capability and the 24x7 operations that run it. This is a strategic people-leadership role. You will set direction, build and scale a multi-team organization, and represent cyber defense to executive stakeholders.\nIn this role you will\nOwn end-to-end leadership of the D&R and SOC teams, including engineers and analysts across detection engineering, incident response, and 24x7 monitoring/triage.\n\nOwn 24x7 staffing model, on-call rotations, and resource allocation across time zones to ensure continuous coverage; participate in leadership escalation on-call as needed.\n\nDefine and drive the multi-year strategy and roadmap for detection engineering, threat hunting, incident response, and security operations.\n\nStay close enough to the technology (SIEM, EDR, NDR, SOAR, cloud-native and vehicle/embedded environments) to make architecture and prioritization calls, review technical strategy with your leads, and step in on the highest-stakes technical problems or incidents.\n\nOwn end-to-end incident response posture - from detection through containment, eradication, recovery, and post-incident reviews. Serve as the executive point of contact for cybersecurity incidents and audits.\n\nOversee cloud vulnerability management: ensure findings are triaged by severity/exploitability, owners are assigned, and remediation or compensating controls are tracked to closure against SLAs.\n\nOversee design, development, and implementation of detections, tooling and Cross Functional projects that touch Cloud, Enterprise, and On-Vehicle D&R/SOC.\n\nOwn and report on KPIs, telemetry coverage, alert fidelity, and SOC efficiency and maturity to executive leadership.\n\nRequired qualifications\n15+ years of progressive cybersecurity experience, including 6+ years leading, managing, and scaling detection engineering and security operations teams.\n\nCurrent hands-on experience with detection engineering, threat hunting, or incident response sufficient to credibly guide technical strategy and support your team.\n\nStrong working knowledge of SIEM, EDR, NDR/SOAR, and modern detection and response tooling. Strong understanding of cloud-native environments (AWS, Kubernetes) and enterprise/endpoint security (Linux, macOS, Windows).\n\nDeep knowledge of the MITRE ATT&CK framework, NIST CSF, and modern adversarial techniques.\n\nEnd-to-end incident management experience, driving cross-departmental collaboration through high-severity incidents.\n\nExperience with vulnerability management, including triage/prioritization of findings and driving remediation across engineering teams.\n\nDemonstrated experience building a metrics/reporting program from scratch (defining metrics, implementing measurement, and coaching a team to deliver insight rather than raw data) for a technical function.\n\nWorking proficiency in Python and/or C++.\n\nExperience building and maintaining security data lakes and big data tooling (e.g., AWS Athena, Snowflake, SQL/data warehousing).\n\nExperience designing and implementing Zero Trust Architecture.\n\nExperience with low-level data collection frameworks (e.g., auditd, sysmon, eBPF).\n\nFamiliarity with systems architecture, distributed systems, and microservices, and with performance monitoring/capacity planning for network operations.\n\nExperience with DevSecOps, CI/CD, and Infrastructure-as-Code (e.g., Git, Terraform).\n\nDesirable qualifications\nExperience with vehicle/embedded or OT security, or strong willingness to ramp up quickly in this area.\n\nFor roles based in Mountain View, CA and Seattle, WA: The salary range for this position is $247,000 - $396,000 per year.\nFor roles based in Pittsburgh, PA: The salary range for this position is $223,000 - $357,000 per year.\nAurora’s pay ranges are determined by role, level, and location. Within the range, the successful candidate’s starting base pay will be determined based on factors including job-related skills, experience, qualifications, relevant education or training, and market conditions. These ranges may be modified in the future. The successful candidate will also be eligible for an annual bonus, equity compensation, and benefits.\nWorking at Aurora\nAt Aurora, we bring together extraordinarily talented and experienced people united by the strength of our values. We operate with integrity, set outrageous goals, and build a culture where we win together - all without any jerks.\nWe believe in-person work increases collaboration, empathy, and our ability to lead effectively. As a result, Aurorans are expected to work from the office at least 3 days per week, with some roles requiring more frequent in-office presence, up to 5 days per week, based on operational needs.\nOurCareers page provides insight into what it is like to work at Aurora, and you can find all the latest updates in our Newsroom.\nOur commitment to safety\nAt the core of everything we do is our commitment to safety. Building best-in-class self-driving technology will take time, and we believe that each employee at Aurora has a role in contributing to safety, every step of the way. Aurora expects commitment to our safety policies from every employee, and seeks candidates who take an active responsibility, can contribute to building an atmosphere of trust, and invest in the organization’s long-term success by prioritizing working safely, no matter what.\nOur commitment to inclusion\nAurora considers candidates without regard to their race, color, religion, national origin, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, pregnancy status, parent or caregiver status, ancestry, political affiliation, veteran and/or military status, physical or mental disability, or any other status protected by federal or state law. Aurora considers qualified applicants with criminal histories, consistent with applicable federal, state, and local law. We are also committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, you may contact us at .\nFor California applicants, information collected and processed as part of your application and any job applications you choose to submit is subject to Aurora’s California Employment Privacy Policy.","description_format":"text","description_chars":7323,"description_truncated":false,"requirements":{"experience_years_min":15,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Pennsylvania","iso":null,"kind":"city"},{"name":"Washington","iso":null,"kind":"city"},{"name":"California","iso":null,"kind":"city"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Autonomous Driving","Logistics","Incident Response"],"lifecycle":[{"event":"open","at":"2026-10-21T08:21:37Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":19,"expected_fill_days":77,"reasons":["conf:3","velocity","win:early"],"computed_at":"2026-10-25T05:49:26Z"},"pay":{"stated_usd_annual":396000,"is_top_pay":true},"html_url":"https://alion.io/job/aurora-director-security-operations-detection-engineering","json_url":"https://alion.io/job/aurora-director-security-operations-detection-engineering.json","meta":{"generated_at":"2026-10-26T03:12:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4235,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":40481},"rest":"https://alion.io/mcp/rest/get_company?id=40481"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Faurora-director-security-operations-detection-engineering"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Faurora-director-security-operations-detection-engineering"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Faurora-director-security-operations-detection-engineering"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/aurora-director-security-operations-detection-engineering\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Faurora-director-security-operations-detection-engineering"}]}