Director, DT Threat Detection & Engineering- 90284261 - null

Amtrak

3d•$179,300 - $232,416•Remote

About The Position

Play a critical role in leading and advancing the organization's threat detection and cyber defense engineering capabilities. Responsible for overseeing the development, implementation, and continuous improvement of cyber threat detections, security automation, and defensive engineering solutions that support the Security Operations Center (SOC), Cyber Threat Intelligence (CTI), Threat Hunting, and Penetration Testing teams. Lead a team of detection engineers and cybersecurity developers responsible for building and maintaining scalable detection content across multiple security platforms, developing SOAR automations, integrating threat intelligence into security controls, and creating innovative cyber defense capabilities. Drive the organization's ability to rapidly detect, investigate, and respond to evolving cyber threats while advancing operational efficiency through automation and engineering excellence.

Requirements

Bachelor's Degree or equivalent combination of education, training, and/or relevant experience.
Plus 11 years of relevant cybersecurity experience, including security operations, detection engineering, threat intelligence, threat hunting, incident response, security automation, or cyber defense engineering.
Experience leading technical cybersecurity teams and managing complex security engineering initiatives
Proficiency with software development methodologies, DevSecOps, and CI/CD pipelines
Experience with GitHub, source control management, and automated deployment frameworks.
Knowledge of cloud platforms, APIs, automation frameworks, and enterprise integrations.
Proven ability to lead and mentor high-performing teams of detection engineers, security automation engineers, and cybersecurity developers.
Foster a culture of innovation, accountability, collaboration, and continuous improvement.
Provide technical leadership and career development opportunities for engineering teams.
Deep understanding of cybersecurity operations, threat detection methodologies, threat intelligence, incident response, threat hunting, and adversary tactics, techniques, and procedures (TTPs).
Strong technical expertise across SIEM, SOAR, EDR/XDR, cloud security, network security monitoring, log analytics, security orchestration, and automation platforms.
Demonstrated ability to design, build, and optimize threat detections across diverse technology environments and security tools.
Experience operationalizing intelligence-driven and behavior-based detection strategies aligned to frameworks such as MITRE ATT&CK.
Knowledge of software development practices, scripting languages, APIs, automation frameworks, and cybersecurity engineering methodologies.
Ability to establish measurable performance indicators and drive continuous improvement in detection quality, coverage, and operational efficiency.
Strong analytical and problem-solving skills with the ability to assess complex threats and develop effective defensive engineering solutions.
Understanding of regulatory requirements, cybersecurity frameworks, and industry standards, including NIST Cybersecurity Framework, NIST 800-53, ISO 27001, and related guidance.
Exceptional communication and stakeholder management skills with the ability to translate complex technical concepts into meaningful business outcomes for executive and non-technical audiences.
Strategic mindset with the ability to anticipate emerging threats, evolving attack techniques, and future cybersecurity trends while developing proactive defense capabilities.

Nice To Haves

Bachelor's Degree or equivalent combination of education, training, and/or relevant experience.
Plus 13 years of relevant cybersecurity experience.
Experience leading enterprise-scale Threat Detection Engineering, Security Operations, Security Automation, or Cyber Defense programs.
Relevant industry certifications such as CISSP, GIAC (GCDA, GCTI, GMON, GCFA, or similar), CCSP, or related cybersecurity certifications.
Experience implementing MITRE ATT&CK-based detection programs and SOAR/SIEM platforms in complex enterprise environments.
Experience supporting enterprise-scale cyber data lake or security data pipeline architectures.
Knowledge of cloud-native security platforms and large-scale security analytics environments.

Responsibilities

Develop and execute the strategic vision for Threat Detection & Engineering aligned with cybersecurity objectives and emerging threats.
Establish and maintain a threat detection strategy leveraging threat intelligence, threat hunting, penetration testing, and incident response findings.
Lead, mentor, and develop teams of detection engineers, automation engineers, and cyber defense developers while fostering innovation and operational excellence.
Define roadmaps, performance metrics, and maturity goals to improve detection coverage, automation, and engineering capabilities.
Manage staffing, budgeting, workforce planning, and performance management.
Oversee the design, implementation, and lifecycle management of threat detections across SIEM, EDR/XDR, cloud, network, and identity security platforms.
Ensure detections are aligned to MITRE ATT&CK and relevant threat actor TTPs.
Drive continuous tuning to improve detection fidelity, reduce false positives, and enhance analyst effectiveness.
Partner with CTI, Threat Hunting, Incident Response, and Penetration Testing teams to transform intelligence and findings into actionable detections.
Lead development of SOAR workflows, automated response capabilities, and orchestration solutions to improve operational efficiency and reduce MTTD/MTTR.
Oversee development of security tools, integrations, APIs, and engineering solutions that enhance detection, investigation, response, and reporting.
Ensure solutions are scalable, maintainable, and aligned with enterprise architecture and cybersecurity standards.
Partner with SOC leadership to ensure detection and automation capabilities support monitoring and incident response needs.
Collaborate with Cyber Threat Intelligence, Threat Hunting, and Red Team/Penetration Testing functions to operationalize intelligence, validate detection effectiveness, identify gaps, and strengthen defenses.
Assess detection coverage, identify control gaps, and prioritize engineering efforts to mitigate cyber risk to critical systems and data.
Ensure compliance with regulatory requirements, industry standards, cybersecurity frameworks, and organizational policies.
Develop metrics, reporting, and executive communications that provide visibility into detection effectiveness, automation maturity, operational performance, and risk reduction.