Manager, Threat Detection Engineering

Vanguard•Malvern, PA

1d•Hybrid

About The Position

The Manager, Threat Detection Engineering leads a team of threat detection engineers within the Vanguard CSOC, responsible for the strategy, execution, and continuous maturation of the organization's threat detection capabilities. This role sits at the intersection of people leadership, technical excellence, and security strategy to guide a high-performing engineering team that translates adversary behaviors into high-fidelity, scalable detections across the full security stack. The manager will set team direction, drive measurable outcomes, and serve as a key stakeholder and partner across the CSOC including Threat Hunting, Adversary Emulation, Cyber Threat Intelligence, and Incident Management, to advance Vanguard's defensive posture against the evolving cybersecurity threat landscape.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, or a related field preferred
7+ years of experience in security operations, detection engineering, threat hunting, incident response, or a closely related discipline
People management or formal team leadership experience in a security engineering context
Hands-on experience writing and tuning detections in one or more SIEM platforms
Hands-on background with SOAR or security automation platforms
Experience with endpoint detection and response (EDR) and/or asset visibility and control platforms
Strong familiarity and working knowledge of MITRE ATT&CK, Cyber Kill Chain, or similar frameworks and their application to detection strategy
Familiarity with detection-as-code concepts, including version control, code review workflows, and CI/CD pipelines
Demonstrated ability to define team roadmaps, manage priorities, and deliver programs against measurable goals
Expert-level understanding of the threat landscape including adversary tools such as C2 frameworks, RMMs, credential theft utilities, proxy and tunneling tools, cloud attack tooling, data exfiltration utilities, malware loaders, ransomware, and post-exploitation frameworks, and the TTPs associated with their use
Strong communication skills with the ability to translate technical concepts for both engineering audiences and senior leadership
Experience building or scaling a detection engineering program or practice from the ground up

Responsibilities

Lead, mentor, and develop a team of threat detection engineers, fostering a culture of technical excellence, continuous learning, and collaboration
Conduct regular 1:1s, performance reviews, and career development conversations to grow individual contributors and retain top talent
Identify skill gaps and build targeted training, development plans, and knowledge-sharing programs within the team
Drive hiring, onboarding, and team capacity planning in partnership with HR and senior leadership
Define and own the detection engineering roadmap, aligning team priorities to the broader CSOC strategy and Vanguard's risk posture
Develop and maintain the team's detection engineering framework, methodology, and standards across all platforms and workflows
Drive the team's MITRE ATT&CK coverage strategy, establishing measurable goals and tracking progress over time
Stay current on the evolving threat landscape and adversary tradecraft, ensuring the team's detection philosophy reflects emerging attacker behaviors
Champion detection-as-code adoption and engineering best practices across the CSOC
Oversee the delivery of custom threat detection content across the full security stack, including SIEM, EDR, CNAPP, ITP, NIDS/NIPS, and SaaS security monitoring platforms
Manage detection intake and prioritization from Purple Team and Red Team findings, threat intelligence, incident retrospectives, and investigation reviews
Ensure the team maintains structured development, review, and deployment pipelines for all detection content
Drive automation and orchestration initiatives using SOAR platforms, CI/CD pipelines, and AI-assisted tooling to improve team efficiency and detection velocity
Oversee development and maintenance of synthetic unit test frameworks for detection validation
Define, track, and report on key detection engineering metrics including coverage, detection quality, false positive rates, mean time to detect (MTTD), and backlog health
Provide regular program updates to CSOC leadership and stakeholders on team performance, program health, and strategic initiatives
Maintain visibility into detection gaps and remediation progress, driving accountability to measurable outcomes
Contribute to board and executive-level reporting on detection capability maturity as needed
Partner closely with Threat Hunting, Adversary Emulation, Cyber Threat Intelligence, and Incident Management teams to ensure detection content reflects real-world threats and operational feedback
Represent the detection engineering team in Red Team and Purple Team exercises, translating exercise outcomes into actionable detection improvements
Collaborate with platform and infrastructure teams to ensure detection tooling is properly maintained, scaled, and integrated