The Manager, Threat Detection Engineering leads a team of threat detection engineers within the Vanguard CSOC, responsible for the strategy, execution, and continuous maturation of the organization's threat detection capabilities. This role sits at the intersection of people leadership, technical excellence, and security strategy to guide a high-performing engineering team that translates adversary behaviors into high-fidelity, scalable detections across the full security stack. The manager will set team direction, drive measurable outcomes, and serve as a key stakeholder and partner across the CSOC including Threat Hunting, Adversary Emulation, Cyber Threat Intelligence, and Incident Management, to advance Vanguard's defensive posture against the evolving cybersecurity threat landscape.
Core ResponsibilitiesPeople Leadership- Lead, mentor, and develop a team of threat detection engineers, fostering a culture of technical excellence, continuous learning, and collaboration
- Conduct regular 1:1s, performance reviews, and career development conversations to grow individual contributors and retain top talent
- Identify skill gaps and build targeted training, development plans, and knowledge-sharing programs within the team
- Drive hiring, onboarding, and team capacity planning in partnership with HR and senior leadership
Strategy & Program Ownership- Define and own the detection engineering roadmap, aligning team priorities to the broader CSOC strategy and Vanguard's risk posture
- Develop and maintain the team's detection engineering framework, methodology, and standards across all platforms and workflows
- Drive the team's MITRE ATT&CK coverage strategy, establishing measurable goals and tracking progress over time
- Stay current on the evolving threat landscape and adversary tradecraft, ensuring the team's detection philosophy reflects emerging attacker behaviors
- Champion detection-as-code adoption and engineering best practices across the CSOC
Execution & Delivery- Oversee the delivery of custom threat detection content across the full security stack, including SIEM, EDR, CNAPP, ITP, NIDS/NIPS, and SaaS security monitoring
- platforms
- Manage detection intake and prioritization from Purple Team and Red Team findings, threat intelligence, incident retrospectives, and investigation reviews
- Ensure the team maintains structured development, review, and deployment pipelines for all detection content
- Drive automation and orchestration initiatives using SOAR platforms, CI/CD pipelines, and AI-assisted tooling to improve team efficiency and detection velocity
- Oversee development and maintenance of synthetic unit test frameworks for detection validation
Metrics & Reporting- Define, track, and report on key detection engineering metrics including coverage, detection quality, false positive rates, mean time to detect (MTTD), and backlog
- health
- Provide regular program updates to CSOC leadership and stakeholders on team performance, program health, and strategic initiatives
- Maintain visibility into detection gaps and remediation progress, driving accountability to measurable outcomes
- Contribute to board and executive-level reporting on detection capability maturity as needed
Cross-Functional Partnership- Partner closely with Threat Hunting, Adversary Emulation, Cyber Threat Intelligence, and Incident Management teams to ensure detection content reflects real-world threats and operational feedback
- Represent the detection engineering team in Red Team and Purple Team exercises, translating exercise outcomes into actionable detection improvements
- Collaborate with platform and infrastructure teams to ensure detection tooling is properly maintained, scaled, and integrated
Qualifications- Bachelor's degree in Cybersecurity, Information Technology, or a related field preferred
- 7+ years of experience in security operations, detection engineering, threat hunting, incident response, or a closely related discipline
- People management or formal team leadership experience in a security engineering context
- Hands-on experience writing and tuning detections in one or more SIEM platforms
- Hands-on background with SOAR or security automation platforms
- Experience with endpoint detection and response (EDR) and/or asset visibility and control platforms
- Strong familiarity and working knowledge of MITRE ATT&CK, Cyber Kill Chain, or similar frameworks and their application to detection strategy
- Familiarity with detection-as-code concepts, including version control, code review workflows, and CI/CD pipelines
- Demonstrated ability to define team roadmaps, manage priorities, and deliver programs against measurable goals
- Expert-level understanding of the threat landscape including adversary tools such as C2 frameworks, RMMs, credential theft utilities, proxy and tunneling tools, cloud attack tooling, data exfiltration utilities, malware loaders, ransomware, and post-exploitation frameworks, and the TTPs associated with their use
- Strong communication skills with the ability to translate technical concepts for both engineering audiences and senior leadership
- Experience building or scaling a detection engineering program or practice from the ground up
Special FactorsSponsorshipVanguard is not offering visa sponsorship for this position.
