Director, Threat Detection & Response

NorthAB LLC•Remote work MI, MI

1d•$175,000 - $235,000•Remote

About The Position

North is seeking a Director of Threat Detection and Response to serve as a key cybersecurity and technical leader. The role defines strategy and builds capabilities across Incident Response, Detection Engineering, Threat Hunting, and Cyber Threat Intelligence. The director oversees the prevention, detection, and response to complex cybersecurity threats targeting North's payment processing infrastructure, leads a team of experienced experts, maintains high technical standards across cloud, network, endpoint, and identity security, and serves as the ultimate escalation point for executive leadership during critical incidents.

Requirements

Bachelor's degree in Computer Science, Cyber Security, or a related field, or a combination of education and experience.
10+ years of hands-on information security experience, with deep expertise in incident response, detection engineering, and threat hunting.
Hands-on expertise managing complex security incidents, advanced threat hunting, and detection engineering across cloud, identity, network, and endpoint environments.
Demonstrated leadership overseeing complex security operations and high-performing technical teams.
Proficiency with advanced incident response tools, digital forensic protocols, log analysis techniques, and managing detection rules in modern platforms.
Strong expertise in log management and telemetry, including designing and overseeing log collection architectures and data pipelines across complex cloud and on-premises environments.
Expertise in the intersection of AI and cybersecurity, including investigating attacks on AI agents, countering AI-facilitated threats, and integrating AI agents into incident response workflows.
Architectural understanding of internal AI and agentic infrastructure, including secure deployment, monitoring, and incident readiness for in-house models and autonomous agent networks.
Solid understanding of AWS, Azure, and GCP cloud infrastructure, Windows/Linux systems, and modern identity platforms.
Familiarity with the payments/fintech regulatory environment, including working knowledge of PCI-DSS.
Excellent communication skills and demonstrated ability to brief executive leadership, legal, and compliance teams during high-pressure situations.

Nice To Haves

GIAC Certified Forensic Analyst (GCFA)
GIAC Certified Incident Handler (GCIH)
GIAC Network Forensic Analyst (GNFA)
GIAC Cyber Threat Intelligence (GCTI)
Offensive Security Certified Professional (OSCP)
Offensive Security Incident Response (OSIR)
CompTIA CySA+

Responsibilities

Serve as the senior incident commander and ultimate escalation point during major, high-severity security incidents.
Direct incident response strategy, ensuring rapid triage, containment, eradication, and recovery across endpoint, network, cloud, identity, and application layers.
Oversee digital forensics and root cause analysis, drive cross-team remediation of systemic gaps, and mitigate fraud or financial loss.
Direct detection engineering strategy and ensure the development, tuning, and validation of high-fidelity detection logic.
Lead proactive, hypothesis-driven threat hunting programs based on incident trends and the MITRE ATT&CK framework.
Build and integrate Cyber Threat Intelligence capabilities to identify and counter emerging adversary TTPs relevant to the payments industry.
Drive the strategy and buildout of enterprise logging and data pipelines to provide visibility across cloud and on-premises environments.
Manage, mentor, and develop a high-performing team of senior incident responders, detection engineers, and threat hunters.
Translate technical findings and incident outcomes into clear, actionable narratives for executive leadership and the board of directors.