Senior Manager, Security Platform Engineering

Manage two system-aligned engineering teams covering the Detection Engine, TIP, SOAR, and Case Management

Own hiring, performance, coaching, and career development for the engineering group, including developing team leads and senior engineers into broader leadership responsibilities

Maintain a high technical bar through design reviews, code review standards, and architectural guidance

Own the definition of done: establish acceptance criteria for security-facing functionality with operator sign-off from SOC, Detection Engineering, and Threat Intelligence

Own production operations for these systems: on-call rotations, incident review, SLOs, and reliability engineering

Own release quality and delivery predictability across both teams

Coordinate shared infrastructure, deploy tooling, and engineering standards with our central Engineering organization

Own the roadmap for the Detection Engine, TIP, SOAR, and Case Management, balancing operator needs, platform health, and partner-visible improvements

Run product discipline for these systems: quarterly planning, success metrics, and written problem statements for major initiatives

Own the quality and roadmap of partner-visible surfaces—case presentation foremost, as the primary way partners see the value of our security work—drawing partner signal from our customer-facing teams and coordinating with Product Management on go-to-market and the SIEM boundary

Own the alert-working and threat hunting workflows these systems provide: investigation surfaces, hunt tooling and query capabilities, and the alert-to-case lifecycle

Set and evolve the architectural direction for streaming detection infrastructure, intelligence pipelines, and automation systems

Contribute through design documents, prototypes, and technical standards—staying out of critical-path delivery

Guide how these platforms support practitioner-built automation: the APIs, workflow primitives, and extensibility that let security teams build detection authoring, enrichment, and validation workflows on the systems

Ensure the Detection Engine, Case Management, and supporting systems expose the data, APIs, and integration points our AI SOC capabilities depend on, in close partnership with the AI/ML team that owns that initiative

Work directly with Detection Engineering, Threat Intelligence, and MXDR as the customers of these systems: intake their requirements, close feedback loops, and treat operator effectiveness as the primary measure of success

Translate operational pain into engineering priorities, and engineering trade-offs back into terms practitioners can act on

Partner with these teams on telemetry, alert-working workflows, hunt tooling, and case presentation improvements

Own outcomes including:

System reliability and SLO attainment for the Detection Engine, TIP, and SOAR

Delivery predictability and quality across both teams

Team health, retention, and leadership development

Track and improve metrics such as:

Operator-reported tooling effectiveness (SOC, DE, TI acceptance and satisfaction)

Incident frequency and time-to-recovery for owned systems

Cycle time from accepted requirement to production

Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience

8+ years in software or security engineering, including significant experience building security products or detection/response tooling

3+ years managing engineering teams, with experience managing 8+ engineers or multiple teams

Experience developing team leads or first-line managers

Track record of owning production systems: on-call programs, incident management, SLOs

Experience establishing delivery quality practices: acceptance criteria, review standards, release discipline

Proven ability to set architectural direction while staying out of the critical path

Experience running roadmap and prioritization processes across multiple teams

Experience operating across organizational boundaries with shared infrastructure and platform teams

Strong written communication: design documents, roadmaps, and decision records

Ability to represent engineering trade-offs to security practitioners and security needs to engineering organizations

Experience at a security vendor building detection, SIEM, SOAR, or intelligence products

Experience in an enterprise detection & response organization that built its own tooling

Experience with MSP/MSSP or multi-tenant platform delivery