Lead Director, Threat Intelligence & Detection Engineering

Who You Are

• Experienced in building and leading high-performance security teams focused on threat hunting, cyber resilience, and proactive defense strategies.
• Strong expertise in identifying, analyzing, and mitigating advanced threats, with a deep understanding of adversarial tactics, techniques, and procedures (TTPs).
• Skilled in building threat-hunting frameworks that leverage SIEMs, endpoint detection, and threat intelligence to proactively detect and mitigate potential attacks.
• A leader in next-generation security approaches, leveraging AI, machine learning, and automation to enhance threat detection, analysis, and remediation processes.
• Experienced in developing key security metrics (KPIs/KRIs) to track the effectiveness of defense strategies, continuously improving threat detection, response, and remediation processes.

Role Responsibilities

Threat Hunting & Defensive Strategy

• Lead the development and execution of proactive threat-hunting strategies, utilizing cutting-edge technologies such as AI, machine learning, and advanced analytics to detect, respond, and mitigate threats.
• Build and maintain threat-hunting frameworks that leverage MITRE ATT&CK, Cyber Kill Chain, and the Diamond Model of Intrusion Analysis, alongside tools such as SIEM, endpoint detection, and threat intelligence platforms, to continuously identify and eliminate security threats.
• Continuously assess and update detection and defense strategies based on evolving threat landscapes, ensuring that the organization remains resilient against sophisticated attacks.
• Incorporate detection and mitigation strategies for advanced AI and LLM-based threats, such as adversarial attacks and model abuse through platforms like Hugging Face, to identify and eliminate sophisticated attack vectors early.

Incident Response and Cyber Resilience

• Oversee the implementation and continuous improvement of the organization's incident detection and response capabilities, ensuring rapid identification, containment, and remediation of security incidents.
• Develop and execute cyber resilience strategies that ensure the organization's ability to recover quickly from potential incidents while minimizing operational impact.
• Lead the development of playbooks, response plans, and automated remediation workflows, ensuring the team is well-prepared to handle any potential threat or breach.

Next-Generation Security & Automation

• Leverage artificial intelligence, machine learning, and automation to enhance threat detection and response processes, reducing reliance on manual workflows.
• Implement adversarial deception techniques, such as honeypots, decoys, and deception technologies, to mislead attackers and gain insights into their tactics, techniques, and procedures (TTPs).
• Drive the adoption of next-generation technologies, including SOAR platforms, adversary emulation, deception technologies, and behavioral analytics, to improve the speed and accuracy of threat detection, with a focus on automation and scalability.

Threat Intelligence Sharing

• Build strong partnerships with external threat intelligence providers and internal stakeholders to enhance the organization's ability to anticipate, detect, and mitigate threats.
• Lead the sharing of threat intelligence insights with internal teams to ensure timely updates on evolving threats and trends.
• Drive collaboration across the organization to ensure security controls are aligned with business goals and operational needs.

Qualifications

• 10+ years of experience in leading threat-hunting or defensive security teams, with a significant portion in a senior leadership role.
• A minimum of a Bachelor’s degree in Computer Science, Information Security, Software Engineering, or a related field, or equivalent alternative education, skills, and/or practical experience is required.
• Industry certifications such as CISSP, GCIH, GCIA, CEH, or CISM are highly preferred. Cloud-specific certifications such as GCP Cloud Security Engineer, AWS Certified Security, Azure Security Engineer are a plus, but not required.
• Strong expertise in threat-hunting frameworks, cyber resilience strategies, and incident response processes.
• Experience with one or more general-purpose programming/script languages including but not limited to: Java, C/C++, C#, Python, JavaScript, Shell Script, PowerShell, with a focus on automation for detection and remediation processes.
• Proven ability to leverage automation, AI, and machine learning to improve detection and remediation processes.
• Experience with threat intelligence platforms, SIEM tools, endpoint detection, and response (EDR) systems.
• Strong technical expertise with detection techniques across cloud, on-prem, and hybrid environments.
• Demonstrated ability to lead high-performing teams, cultivate talent, and foster a collaborative culture that drives innovation and excellence in threat detection.