Director, Cyber Security Detection Engineering

AstraZeneca • Gaithersburg, MD

1d • $169,320 - $253,980 • Hybrid

About The Position

The Director, Cyber Security Detection Engineering is a senior leader in AstraZeneca’s Cyber Operations function, based in Gaithersburg, Maryland, and works with the Head of Cyber Operations. The role leads enterprise detection capabilities across cloud, on-premises, and OT/ICS environments; owns detection governance and validation; and provides executive reporting, coverage assessments, and capability maturation. The director partners with GSOC, CTI, Vulnerability Management, Offensive Security, IT, Legal, Risk and Compliance, and business customers.

The role sets and executes detection engineering strategy and roadmaps spanning data engineering, detection development, purple teaming, and automation/AI. It oversees telemetry pipelines, detection content and testing across SIEM, EDR, and cloud-native tools, purple team exercises, and automation that supports detection and investigation. The director establishes policies, standards, performance targets, and reporting, and leads the development and performance of teams across these capabilities.

The position is based in Gaithersburg, Maryland. In-person work is expected an average of at least three days per week, with individual flexibility. The annual base pay range is $169,320–$253,980. The role also offers a short-term incentive bonus opportunity and, for salaried roles, eligibility to participate in an equity-based long-term incentive program. Benefits include a qualified retirement program (401(k)), paid vacation and holidays, paid leaves, and medical, prescription drug, dental, and vision coverage.

Requirements

• Bachelor’s degree.
• At least 7 years of experience.
• Proven leadership across the detection development, testing, deployment, and tuning lifecycle at enterprise scale; deep understanding of detection logic design, coverage mapping, and efficacy validation.
• Extensive knowledge of MITRE ATT&CK, Cyber Kill Chain, and detection engineering methodologies; experience mapping organizational coverage and prioritizing development based on threat intelligence.
• Experience designing and conducting adversary emulation exercises and translating purple team findings into detection improvements.
• Experience operationalizing SIEM, XDR, and SOAR platforms, including AI, machine learning, and agentic features.
• Proficiency in data pipeline architecture, log aggregation, normalization, and query optimization, with understanding of data quality requirements for detection.
• Deep understanding of detection across multi-cloud environments, identity systems, endpoints, and network infrastructure; familiarity with cloud-native security services and integration patterns.
• Experience coordinating detection engineering in industrial/OT environments with safety, availability, and production continuity considerations; knowledge of industrial protocols and OT-specific threats.
• Demonstrated experience managing detection engineering or security operations in enterprise-sized organizations across hybrid cloud, on-premises, and OT environments.
• Experience integrating and working with global, 24×7, geographically dispersed teams to deliver detection capabilities and support security operations.
• Ability to explain complex technical concepts in business terms, produce concise executive updates and coverage reports, and lead briefings for diverse stakeholders.
• Ability to analyze complex threat landscapes, assess detection gaps, and balance strategic development with operational requirements, risk appetite, and resource constraints.
• Ability to collaborate across regions and functions, including GSOC, IT, Legal, GRC, and business units, with a strong service approach and commitment to organizational resilience.

Nice To Haves

• Security certifications such as CISSP, CISM, GIAC certifications (for example, GCIA, GCDA, or GMON), cloud certifications, or ITIL.

Responsibilities

• Direct the development and execution of detection engineering programs aligned with organizational risk appetite and the threat landscape.
• Establish capability roadmaps for data engineering, detection development, purple teaming, and automation/AI.
• Ensure telemetry collection, normalization, and quality assurance across hybrid and OT environments; define data retention, schema standards, and platform configuration.
• Oversee the creation, testing, and deployment of detection logic across SIEM, EDR, and cloud-native tools; establish standards, naming conventions, and MITRE ATT&CK mapping, and prioritize coverage using threat intelligence and risk assessments.
• Oversee purple team operations and adversary emulation exercises, validate detection efficacy, and drive remediation of identified detection gaps.
• Operationalize AI agents, machine learning models, and orchestration workflows; oversee automated enrichment, triage, and investigation playbooks.
• Own detection engineering targets, including MITRE ATT&CK coverage, mean time to detect, false-positive rates, and purple team success metrics; provide executive briefings, dashboards, and quarterly maturity assessments.
• Develop and enforce detection engineering policies, standards, and quality frameworks; maintain version-controlled detection content libraries and ensure regulatory compliance in data handling.
• Develop and maintain detection engineering area plans aligned with Cyber Operations strategy, and set goals across data engineering, detection development, purple teaming, and automation.
• Define and review reporting and team targets aligned with detection outcomes, coverage improvements, and operational efficiency.
• Lead inclusive recruitment and build career paths and targeted upskilling in detection development, threat hunting, cloud security, OT/ICS detection, and SOAR/AI through partnerships.

Benefits

• Short-term incentive bonus opportunity.
• Eligibility to participate in an equity-based long-term incentive program for salaried roles.
• Qualified retirement program (401(k) plan).
• Paid vacation and holidays.
• Paid leaves.
• Medical, prescription drug, dental, and vision coverage.

What This Job Offers

• Job Type: Full-time
• Career Level: Director