{"id":2233756,"url":"https://alion.io/job/one-identity-detection-and-response-lead","title":"Detection and Response Lead","company":{"id":9394,"name":"One Identity","domain":"oneidentity.com","url":"https://alion.io/company/one-identity","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"iCIMS","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":24000,"max_usd":56000,"period":"year","method":"role_seniority_country_cell","sample_n":14},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Agentic Workflows","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Kubernetes","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Telegram","optional":false}],"status":"live","first_seen_at":"2026-10-10T23:25:25Z","employer_posted_date":"2026-10-10","last_verified_at":"2026-10-23T18:14:55Z","board_verified":true,"closed_at":null,"days_open":12,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":12},"description":"Overview\nDetection and Response Lead\nOne Identity · Information Security, Cyber Defense\nSenior individual contributor, practice lead · India · Reports to the Director of Information Security\nWhy this role exists\nOne Identity builds the software that decides who gets into everything else our customers run, and the ground this practice defends is our own: the corporate environment and the hosted services we operate in the cloud. Coverage spans external attacks and insider threats across everything we run, and the detection work is shaped around that full range.\nTwenty-four seven monitoring is handled by a managed provider, which means this is not a shift-rotation job. The provider covers first-line triage and escalates when needed. This role owns everything above the provider: what gets detected in the first place, whether the coverage matches how we're actually attacked, how good the escalations are, and what happens once something real lands on the desk. Directing that relationship well is a large part of the work.\nWe're separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this role leads the detection and response practice inside it. Scope comes from what you build and from the standard you set for what a real incident response looks like here.\nWhat you'll do\nOwn what gets detected\nSet the strategy for detection use cases and own the catalog built from it: identity and authentication abuse, privileged access misuse, cloud control plane activity across Azure and AWS, endpoint and email vectors, and the paths specific to how our own products are deployed internally.\nTreat detections as code. Version them, review them, test them against real telemetry, and track coverage against a threat model rather than a vendor's rule count. Detection changes arrive as pull requests with the reasoning attached.\nOwn the signal quality problem end to end. Tune what's noisy, retire what's dead, and know which gaps are deliberate.\nSet the telemetry standard. Decide what we need to collect and retain to investigate an incident properly, and make the case for it when that costs something.\nOwn the response\nLead incident response from escalation through closure: scoping, containment, evidence handling, root cause, and the write-up that survives a customer or auditor reading it.\nDirect the managed provider. Set escalation criteria, hold the quality bar on what comes through, and close the loop when something should have been caught and wasn't.\nRun the exercises that make a response work under pressure. Tabletops with engineering and leadership, and the runbooks that make an on-call decision obvious at two in the morning.\nOwn the notification path. Know which obligations attach to which kinds of incident, contractual and regulatory, and make sure the clock is understood before it's running.\nWork with product security when an incident touches what we ship. Internal detection and customer-facing disclosure are different disciplines that occasionally share a root cause.\nMake it scale\nDecide where agentic workflows belong in detection and response. Enrichment, correlation, and first-pass investigation are tractable now; containment actions are a harder call. You set where automation acts, where it recommends, and how we verify what it did.\nAutomate the response path itself, not just the alerting. The measure is how much of an investigation is already done by the time a person opens it.\nBring threat intelligence into the practice with an output attached: adversary tradecraft translated into detection use cases, hunts, or control changes.\nAdvance the program's metrics: coverage against the threat model, escalation quality from the provider, time to detect and time to close, reported in terms leadership steers by.\nHunt on a schedule. Structured hypotheses against our own telemetry, and every finding either becomes a detection or gets written down as a deliberate gap.\nWhat we're looking for\nRequired\nEight or more years in security operations, detection engineering, or incident response, with time spent leading incidents rather than only working them. Equivalent depth counts.\nDetection engineering in a modern SIEM, with the query fluency to build and validate rules yourself. We run Microsoft Sentinel and Defender XDR.\nIdentity attack fluency. Entra ID and Active Directory attack paths, token and session abuse, OAuth consent, and federation.\nHands-on work with AI-assisted detection, triage, or investigation within the last six months, and a considered view on where automation should and shouldn't be trusted to act.\nThe three above are the bar. Everything below is depth we'd like and can build. If you meet the requirements and bring most of the rest, apply. We'd rather assess the gap ourselves than have you decide it for us.\nAlso matters: cloud detection across Azure and AWS control planes; scripting and automation in Python or PowerShell; managing or directing an MDR or managed SOC relationship; forensic investigation and evidence handling; writing that holds up when an executive or an auditor reads it.\nHelpful: threat hunting from structured hypotheses; insider risk detection, container and Kubernetes runtime detection, SOAR or workflow automation platforms, threat intelligence work with an operational output, prior time on the engineering side.\nWhat you should know going in\nThis is a practice to build, not a queue to work. The managed tier handles the volume, which leaves you the engineering and the judgment: what we detect, how well, and what happens next. You'll have functional direction of the SOC analysts, with people leadership held by the director, and direct access to engineering leadership. Your incident write-ups will be read at the executive level. If you want to own a detection and response practice rather than inherit someone else's rules, this is that seat.\nCompany Description\nOne Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure to help fuel innovation and drive their businesses forward.\nWith team members around the globe, we intend to continue to grow revenues and add value to customers.\nWhen you join our team, you will have the opportunity to build and develop products at a scale few others can provide.\nOur product portfolio serves a large base of customers and we are addressing the strategic imperatives for enterprise businesses.\nWorking with some of the most talented employees the industry has to offer, we provide enhanced career opportunities for team members to learn and grow in a rapidly changing environment.\nWhy work with us?\nLife at One Identity means collaborating with dedicated professionals with a passion for technology.\nWhen we see something that could be improved, we get to work inventing the solution.\nOur people demonstrate our winning culture through positive and meaningful relationships.\nWe invest in our people and offer a series of programs that enables them to pursue a career that fulfills their potential.\nOur team members’ health and wellness is our priority as well as rewarding them for their hard work.\nOne Identity is an Equal Opportunity Employer and Prohibits Discrimination and Harassment of Any Kind: One Identity is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment.\nAll employment decisions at One Identity are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV Status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate.\nOne Identity will not tolerate discrimination or harassment based on any of these characteristics. One Identity encourages applicants of all ages.\nCome join us.\nNote: We do not use text messaging or third-party messaging apps like Telegram to communicate with applicants, so please exercise caution if you are approached in this way and only interact with people claiming to be One Identity employees if they have an email address ending in @oneidentity.com.","description_format":"text","description_chars":8531,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Identity Management","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-10T23:25:25Z"}],"visa":[],"liveness":{"score":78,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.866,"p_room":0.9,"age_days":12,"expected_fill_days":30,"reasons":["conf:2","velocity","win:mid"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/one-identity-detection-and-response-lead","json_url":"https://alion.io/job/one-identity-detection-and-response-lead.json","meta":{"generated_at":"2026-10-23T19:56:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1198,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":9394},"rest":"https://alion.io/mcp/rest/get_company?id=9394"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fone-identity-detection-and-response-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fone-identity-detection-and-response-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fone-identity-detection-and-response-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/one-identity-detection-and-response-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fone-identity-detection-and-response-lead"}]}