Manager - Detection & Response Engineering

Responsibilities:

• Hire, onboard, coach, and manage performance for a team of Detection and Response Engineers across multiple geographies and time zones.
• Own the team's on-call/rotational coverage model, staffing, and capacity planning to ensure 24/7 detection and response coverage.
• Set quality standards and review processes for detection rule tuning, alert triage, correlation logic, and incident investigations across the team.
• Act as the escalation point for high-severity security incidents, driving containment, eradication, and recommending recovery efforts alongside the team.
• Define and track team KPIs/SLAs (e. g., time-to-detect, time-to-respond, false-positive rates) and report on team performance to leadership.
• Partner with Product and Engineering to feed field-identified detection gaps, tooling needs, and platform feedback into the roadmap.
• Own customer-facing escalations and strategic relationships, including executive-level updates on security posture and incident outcomes.
• Build and maintain playbooks, runbooks, and standard operating procedures for the DRE function.
• Drive continuous improvement of detection content, threat hunting methodology, and response automation across the team.
• Collaborate cross-functionally with Software Development, SRE, and Customer Success teams on onboarding and platform integration.
• Support recruiting, career development, and succession planning to grow the team's technical depth over time.

Requirements:

• 5-8 years in cybersecurity operations, detection engineering, or incident response, including 2+ years in a people management, team lead, or shift-lead capacity.
• Demonstrated experience running or supervising SOC/MDR operations, including on-call and 24/7 coverage models.
• Proven ability to review and improve detection logic, correlation rules, and investigation quality across a team rather than just individually.
• Track record of hiring, coaching, and developing security engineers, including managing performance and career growth.
• Strong incident command experience, leading (not just participating in) containment, eradication, and recovery efforts.
• Excellent written and verbal communication skills, including experience presenting to customers and executive stakeholders.
• Bachelor's degree in Computer Science, Information Security, or a related field.

Preferred Skills:

• Experience managing distributed/global teams across multiple time zones.
• Security aspects of key cloud providers (AWS, Azure, GCP) and familiarity with securing code/identity repositories (GitHub, Atlassian).
• Experience building or scaling a detection engineering or MDR function at a startup or high-growth company.
• MITRE ATT& CK framework expertise and experience embedding it into team detection strategy.
• Familiarity with scripting/automation (Python, Bash) to guide technical decisions, even if not hands-on daily.
• Experience with databases and SQL for reviewing detection and investigation logic.
• Cybersecurity leadership or advanced certifications (e. g., CISSP, GCIH, GCFA, CISM) are a plus.
• Experience partnering with Product/Engineering leadership to influence platform roadmap based on field feedback.