Team Lead, Threat Detection & Incident Response (TDIR)

Lear Corporation•Southfield, MI

About The Position

Lear Corporation is seeking an experienced Team Lead to guide its global Threat Detection & Incident Response (TDIR) team. The Tier 2+ team handles escalations from a 24/7 Managed Security Services Provider (MSSP), leads incident response, performs digital forensics, conducts cyber threat intelligence analysis, and owns the security platforms that support the detection program. This is a hands-on leadership role. The Team Lead serves as the team's technical and process escalation point, mentors team members across three regions, runs key team rhythms, and owns platform health and vendor relationships. The role works closely with the TDIR Manager and contributes to how the team operates, grows, and scales.

Requirements

7+ years of experience in security operations, incident response, threat detection, or digital forensics.
2+ years leading or mentoring others, such as as a team lead, shift lead, or senior analyst with formal mentoring responsibility.
Deep, hands-on incident response experience across endpoint, identity, email, and cloud environments.
Strong working knowledge of EDR and SIEM platforms, including writing queries and detections.
Experience working with or overseeing an MSSP/MDR provider.
Solid understanding of MITRE ATT&CK, the incident response lifecycle, and applying threat intelligence to detection and response.
Excellent written and verbal communication skills, including the ability to brief technical teams and leadership.
Comfort working with a global team and occasionally adjusting hours to support other time zones and active incidents.

Nice To Haves

Experience in manufacturing, automotive, or other large global enterprise environments, including OT exposure.
Scripting or automation skills in PowerShell or Python, and SOAR experience.
Experience managing vendor relationships, SLAs, and QBRs.
Experience building playbooks, training programs, or analyst development plans.
Experience with CrowdStrike Falcon (Insight, Spotlight, and Identity).
Experience with Splunk or Splunk Cloud, including SPL and custom detection development.
Experience with Proofpoint email security.
Experience with Recorded Future threat intelligence.
Experience with a 24/7 MSSP Level 1 triage model and in-house Tier 2+ response.
Preferred, but not required, GIAC certifications: GCIH, GCFA, GCIA, GCTI, or GNFA.
Preferred, but not required, CISSP or CISM certification.
Preferred, but not required, CompTIA CySA+ or CASP+ certification.
Preferred, but not required, vendor certifications such as CrowdStrike CCFR/CCFH or Splunk Certified Power User/Admin.

Responsibilities

Act as the primary technical escalation point for complex investigations, guiding engineers on where to look, what to collect, and whom to engage.
Lead or coordinate responses to significant security incidents, including containment, eradication, recovery, stakeholder communication, and post-incident reviews.
Define, maintain, and improve incident response processes, playbooks, and runbooks aligned with frameworks such as NIST SP 800-61 and MITRE ATT&CK.
Communicate process changes across regions and ensure procedures are followed during incidents.
Track and report operational metrics, such as MTTD/MTTR, escalation quality, and detection coverage, and recommend improvements.
Own the health, adoption, and continuous tuning of security platforms, including EDR, SIEM, email security, threat intelligence, and related tooling.
Keep detections and configurations current with emerging threats; manage upgrades, integrations, and use-case roadmaps.
Ensure platforms are properly documented and knowledge is shared across the team to avoid single points of failure.
Serve as a primary point of contact for the MSSP and key security vendors, ensuring services meet agreed SLAs and organizational expectations.
Participate in Quarterly Business Reviews (QBRs), product reviews, and service improvement plans, and drive resulting action items to completion.