Director, Security Operations & Detection Engineering

Aurora•Mountain View, CA

3d•Hybrid

About The Position

Aurora is seeking a Director of Security Operations & Detection Engineering to lead and unify its Detection & Response (D&R) and Security Operations Center (SOC) functions within the Technical Assurance division. The role owns the strategy, roadmap, and operating rigor for detecting, triaging, investigating, and responding to threats across vehicle, cloud, and enterprise environments. It spans both the engineering of detection capabilities and continuous security operations. This is a strategic people-leadership role responsible for setting direction, building and scaling a multi-team organization, and representing cyber defense to executive stakeholders. The director will remain technically engaged in security architecture and prioritization, oversee incident response and cloud vulnerability management, and report on security operations performance and maturity. Aurora expects employees to work from the office at least three days per week; some roles may require up to five days per week based on operational needs. The position is eligible for an annual bonus, equity compensation, and benefits.

Requirements

15+ years of progressive cybersecurity experience.
6+ years leading, managing, and scaling detection engineering and security operations teams.
Current hands-on experience in detection engineering, threat hunting, or incident response sufficient to guide technical strategy and support the team.
Strong working knowledge of SIEM, EDR, NDR/SOAR, and modern detection and response tooling.
Strong understanding of cloud-native environments, including AWS and Kubernetes, and enterprise/endpoint security across Linux, macOS, and Windows.
Deep knowledge of the MITRE ATT&CK framework, NIST CSF, and modern adversarial techniques.
End-to-end incident management experience, including cross-departmental collaboration during high-severity incidents.
Experience with vulnerability management, including triaging and prioritizing findings and driving remediation across engineering teams.
Demonstrated experience building a metrics and reporting program from scratch for a technical function, including defining metrics, implementing measurement, and coaching a team to deliver insights rather than raw data.
Working proficiency in Python and/or C++.
Experience building and maintaining security data lakes and big data tooling, such as AWS Athena, Snowflake, and SQL/data warehousing.
Experience designing and implementing Zero Trust Architecture.
Experience with low-level data collection frameworks, such as auditd, sysmon, and eBPF.
Familiarity with systems architecture, distributed systems, and microservices, and with performance monitoring and capacity planning for network operations.
Experience with DevSecOps, CI/CD, and Infrastructure-as-Code, such as Git and Terraform.

Nice To Haves

Experience with vehicle/embedded or OT security, or strong willingness to ramp up quickly in this area.

Responsibilities

Lead the D&R and SOC teams, including engineers and analysts across detection engineering, incident response, and 24x7 monitoring and triage.
Own the 24x7 staffing model, on-call rotations, and resource allocation across time zones, and participate in leadership escalation on-call as needed.
Define and drive the multi-year strategy and roadmap for detection engineering, threat hunting, incident response, and security operations.
Guide technology architecture and prioritization across SIEM, EDR, NDR, SOAR, cloud-native, and vehicle or embedded environments; review technical strategy with team leads and support high-stakes technical issues or incidents.
Own the end-to-end incident response posture, from detection through containment, eradication, recovery, and post-incident reviews.
Serve as the executive point of contact for cybersecurity incidents and audits.
Oversee cloud vulnerability management, ensuring findings are triaged by severity and exploitability, assigned to owners, and remediated or covered by tracked compensating controls within SLAs.
Oversee the design, development, and implementation of detections, tooling, and cross-functional projects involving Cloud, Enterprise, and On-Vehicle D&R/SOC.
Own and report KPIs, telemetry coverage, alert fidelity, SOC efficiency, and maturity to executive leadership.
Build and scale the multi-team organization and represent cyber defense to executive stakeholders.