Team Lead, Threat Detection & Incident Response (TDIR)

Lear Corporation•Southfield, MI

About The Position

Lear Corporation is seeking an experienced Team Lead to guide its global Tier 2+ Threat Detection & Incident Response (TDIR) team. The team handles escalations from a 24/7 Managed Security Services Provider (MSSP), leads incident response, performs digital forensics, conducts cyber threat intelligence analysis, and owns the security platforms supporting the detection program. This is a hands-on leadership role. The Team Lead serves as the technical and process escalation point, mentors team members across three regions, runs key team rhythms, and owns platform health and vendor relationships. The role works closely with the TDIR Manager and helps shape how the team operates, grows, and scales.

Requirements

At least 7 years of experience in security operations, incident response, threat detection, or digital forensics.
At least 2 years leading or mentoring others, such as as a team lead, shift lead, or senior analyst with formal mentoring responsibility.
Deep, hands-on incident response experience across endpoint, identity, email, and cloud environments.
Strong working knowledge of EDR and SIEM platforms, including writing queries and detections.
Experience working with or overseeing an MSSP/MDR provider.
Solid understanding of MITRE ATT&CK, the incident response lifecycle, and applying threat intelligence to detection and response.
Excellent written and verbal communication skills, with the ability to brief technical teams and leadership.
Comfort working with a global team and occasionally adjusting hours to support other time zones and active incidents.
Must be legally authorized to work in the country where the position is located.

Nice To Haves

Experience in manufacturing, automotive, or other large global enterprise environments, including OT exposure.
Scripting or automation skills, such as PowerShell or Python, and SOAR experience.
Experience managing vendor relationships, SLAs, and QBRs.
Experience building playbooks, training programs, or analyst development plans.
Experience with CrowdStrike Falcon (Insight, Spotlight, and Identity).
Experience with Splunk or Splunk Cloud, including SPL and custom detection development.
Experience with Proofpoint email security.
Experience with Recorded Future threat intelligence.
Experience with a 24/7 MSSP Level 1 triage and in-house Tier 2+ response model.
Preferred, but not required, certifications: GIAC GCIH, GCFA, GCIA, GCTI, or GNFA; CISSP or CISM; CompTIA CySA+ or CASP+; vendor certifications such as CrowdStrike CCFR/CCFH or Splunk Certified Power User/Admin.

Responsibilities

Act as the primary technical escalation point for complex investigations, guiding engineers on where to look, what to collect, and whom to engage.
Lead or coordinate responses to significant security incidents, including containment, eradication, recovery, stakeholder communication, and post-incident reviews.
Define, maintain, and improve incident response processes, playbooks, and runbooks aligned with frameworks such as NIST SP 800-61 and MITRE ATT&CK.
Communicate process changes across regions and ensure procedures are followed during incidents.
Track and report operational metrics, such as MTTD/MTTR, escalation quality, and detection coverage, and recommend improvements.
Own the health, adoption, and continuous tuning of security platforms, including EDR, SIEM, email security, threat intelligence, and related tools.
Keep detections and configurations current with emerging threats; manage upgrades, integrations, and use-case roadmaps.
Ensure platforms are documented and knowledge is shared across the team to avoid single points of failure.
Serve as a primary point of contact for the MSSP and key security vendors, ensuring services meet agreed SLAs and organizational expectations.
Participate in Quarterly Business Reviews (QBRs), product reviews, and service improvement plans, and drive resulting action items to completion.
Mentor team members across three regions and run key team rhythms.