This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Detection and Response Lead based in India.
This is a senior individual-contributor role responsible for building and leading a modern detection and response practice within a lean, globally distributed security function. You will own the strategy for security detections across identity, cloud, endpoint, email, and other critical attack surfaces. The role combines detection engineering, incident response, threat hunting, automation, telemetry strategy, and managed security provider oversight. You will lead significant incidents from escalation through containment, investigation, root-cause analysis, evidence handling, and executive-ready reporting. A major focus will be improving signal quality, strengthening threat-model-based coverage, and ensuring that managed SOC escalations meet a consistently high standard. You will also shape the responsible use of AI and automation across detection, enrichment, investigation, and response workflows. This is an opportunity to define how a growing security organization detects, investigates, and responds to real-world threats rather than simply inheriting an existing queue of alerts.
- Own the overall strategy and catalog for security detection use cases across identity and authentication abuse, privileged access, Azure and AWS cloud activity, endpoint and email threats, and relevant internal attack paths.
- Build, validate, test, version, review, and continuously improve detections using modern SIEM capabilities and real organizational telemetry.
- Treat detections as engineering assets, documenting the reasoning behind changes and ensuring coverage is measured against a defined threat model rather than simply counting vendor rules.
- Own signal quality end to end by tuning noisy detections, retiring ineffective rules, identifying coverage gaps, and documenting deliberate detection exclusions.
- Establish telemetry requirements for incident investigation, including what data should be collected and retained, and advocate for the resources required to meet those standards.
- Lead incident response from initial escalation through scoping, containment, evidence handling, root-cause analysis, remediation, closure, and executive-quality reporting.
- Direct the relationship with the managed security provider, defining escalation criteria, quality expectations, response standards, and feedback loops.
- Review provider escalations and identify missed detections or weaknesses in monitoring, ensuring corrective actions are implemented.
- Conduct tabletop exercises with engineering and leadership teams and maintain practical incident-response runbooks that support effective decisions during high-pressure events.
- Own the incident notification process, ensuring contractual and regulatory obligations are identified and that relevant stakeholders understand notification timelines.
- Collaborate with Product Security when incidents have implications for products or customer-facing security concerns, maintaining appropriate separation between internal response and external disclosure.
- Determine where AI-assisted and agentic workflows should be used across detection and response, defining appropriate boundaries between autonomous action, recommendations, and human verification.
- Automate investigation and response workflows, with a focus on completing enrichment, correlation, and first-pass investigation before an analyst begins manual review.
- Incorporate threat intelligence into operational security by translating adversary behavior into detection use cases, threat hunts, or control improvements.
- Establish and improve program metrics covering threat-model coverage, provider escalation quality, time to detect, time to respond, and time to close.
- Conduct structured threat hunts based on defined hypotheses and ensure findings are converted into detections, control improvements, or documented risk decisions.
- Provide functional direction to SOC analysts while collaborating closely with security and engineering leadership.
- Produce incident documentation and reports that are clear, technically rigorous, and suitable for executive and audit-level review.
Requirements:
- 8+ years of experience in security operations, detection engineering, incident response, or a closely related discipline, including significant experience leading security incidents.
- Strong hands-on detection engineering experience within a modern SIEM environment, including the ability to independently write, query, validate, and troubleshoot detection rules.
- Experience with Microsoft Sentinel and Microsoft Defender XDR is highly relevant.
- Strong knowledge of identity security and identity-based attack techniques, including Entra ID, Active Directory, token and session abuse, OAuth consent attacks, and federation-related threats.
- Recent hands-on experience with AI-assisted detection, triage, or investigation, ideally within the last six months, combined with a thoughtful understanding of where AI-driven automation can and cannot be trusted to act.
- Experience with cloud detection across Azure and AWS control planes is highly desirable.
- Strong scripting and automation capabilities using Python, PowerShell, or comparable technologies.
- Experience managing or directing an MDR provider or managed SOC relationship is preferred.
- Practical experience with forensic investigation, evidence collection, preservation, and analysis.
- Strong technical writing skills, with the ability to produce incident documentation suitable for executives, auditors, and other senior stakeholders.
- Experience conducting structured threat hunts based on defined hypotheses is an advantage.
- Knowledge of insider-risk detection, container and Kubernetes runtime security, SOAR or workflow automation platforms, and operational threat intelligence is beneficial.
- Previous experience working closely with engineering teams is an advantage.
- Strong analytical judgment and the ability to distinguish meaningful security signals from noise.
- Excellent communication and stakeholder-management skills, particularly during high-severity incidents.
- Ability to operate independently, establish priorities, and make sound decisions within a lean and distributed security organization.
- Strong ownership mindset, with a focus on building durable detection and response capabilities rather than simply managing alert volume.
Benefits:
- Fully remote opportunity based in India.
- Senior individual-contributor position with ownership of a strategic detection and response practice.
- Opportunity to shape detection engineering, incident response, threat hunting, and security automation from the ground up.
- Exposure to modern security technologies spanning SIEM, XDR, cloud security, identity security, automation, and managed SOC operations.
- Direct interaction with security, engineering, and leadership stakeholders.
- Opportunity to influence how AI and agentic automation are responsibly applied to security operations.
- Functional leadership responsibility for SOC analysts without requiring traditional line-management responsibilities.
- Opportunity to develop security processes, metrics, runbooks, detection standards, and response practices.
- Global and distributed working environment with exposure to complex security challenges across cloud and corporate environments.
- Professional growth opportunities within a technology-focused security organization.
- Collaborative culture that values innovation, continuous improvement, technical ownership, and meaningful security outcomes.
- Opportunity to work on high-impact security incidents and initiatives with visibility at senior leadership level.