Director, Threat Detection & Response

Role overview Lead the strategy and technical capabilities for incident response, detection engineering, threat hunting, and cyber threat intelligence. This senior security leadership role oversees the response to complex threats across cloud, network, endpoint, identity, and application environments, and serves as an escalation point during major incidents. The work includes building a strong technical team and improving the visibility and readiness needed to detect and contain attacks.

Responsibilities - Command high-severity security incidents, directing triage, containment, eradication, and recovery across technology layers. - Oversee forensic investigations and root cause analysis, then coordinate remediation to address systemic weaknesses and reduce fraud or financial loss. - Set direction for detection engineering, including development, tuning, and validation of high-confidence detection logic. - Lead hypothesis-driven threat hunts informed by incident patterns and the MITRE ATT&CK framework. - Develop threat intelligence capabilities to track adversary techniques relevant to payment environments. - Guide logging architecture and data pipelines across cloud and on-premises systems to support investigations and detection. - Hire, mentor, and develop experienced responders, detection engineers, and threat hunters; communicate findings to executive and board audiences.

Requirements - Bachelor’s degree in computer science, cybersecurity, or a related field, or an equivalent combination of education and experience. - At least 10 years of hands-on information security experience, including deep expertise in incident response, detection engineering, and threat hunting. - Demonstrated leadership of security operations and technically skilled teams. - Practical command of complex incident handling, digital forensics, log analysis, and detection rule management. - Experience designing telemetry collection and data pipelines in complex cloud and on-premises environments. - Understanding of AWS, Azure, or GCP, Windows and Linux systems, and modern identity platforms. - Ability to brief executives, legal teams, and compliance stakeholders clearly under pressure.

Nice to have - Experience investigating attacks on AI agents, addressing AI-enabled threats, or integrating AI agents into response workflows; understanding of secure, monitored AI infrastructure. - Familiarity with payment or fintech regulation, including PCI-DSS. - Certifications such as GCFA, GCIH, GNFA, GCTI, OSCP, OSIR, or CySA+.

Benefits and work setup The listing describes the position as remote in the United States and gives a salary range of $175,000–$235,000, varying by location and job-related qualifications. Benefits include medical, dental, and vision coverage, flexible paid time off, 401(k) matching, mental health and well-being support, paid parental leave, education assistance, and a company-funded lifestyle spending account. The role is not eligible for current or future visa sponsorship.