Detection and Response Lead

Overview

Detection and Response Lead

One Identity · Information Security, Cyber Defense

Senior individual contributor, practice lead · India · Reports to the Director of Information Security

Why this role exists

One Identity builds the software that decides who gets into everything else our customers run, and the ground this practice defends is our own: the corporate environment and the hosted services we operate in the cloud. Coverage spans external attacks and insider threats across everything we run, and the detection work is shaped around that full range.

Twenty-four seven monitoring is handled by a managed provider, which means this is not a shift-rotation job. The provider covers first-line triage and escalates when needed. This role owns everything above the provider: what gets detected in the first place, whether the coverage matches how we're actually attacked, how good the escalations are, and what happens once something real lands on the desk. Directing that relationship well is a large part of the work.

We're separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this role leads the detection and response practice inside it. Scope comes from what you build and from the standard you set for what a real incident response looks like here.

What you'll do

Own what gets detected

Set the strategy for detection use cases and own the catalog built from it: identity and authentication abuse, privileged access misuse, cloud control plane activity across Azure and AWS, endpoint and email vectors, and the paths specific to how our own products are deployed internally.

Treat detections as code. Version them, review them, test them against real telemetry, and track coverage against a threat model rather than a vendor's rule count. Detection changes arrive as pull requests with the reasoning attached.

Own the signal quality problem end to end. Tune what's noisy, retire what's dead, and know which gaps are deliberate.

Set the telemetry standard. Decide what we need to collect and retain to investigate an incident properly, and make the case for it when that costs something.

Own the response

Lead incident response from escalation through closure: scoping, containment, evidence handling, root cause, and the write-up that survives a customer or auditor reading it.

Direct the managed provider. Set escalation criteria, hold the quality bar on what comes through, and close the loop when something should have been caught and wasn't.

Run the exercises that make a response work under pressure. Tabletops with engineering and leadership, and the runbooks that make an on-call decision obvious at two in the morning.

Own the notification path. Know which obligations attach to which kinds of incident, contractual and regulatory, and make sure the clock is understood before it's running.

Work with product security when an incident touches what we ship. Internal detection and customer-facing disclosure are different disciplines that occasionally share a root cause.

Make it scale

Decide where agentic workflows belong in detection and response. Enrichment, correlation, and first-pass investigation are tractable now; containment actions are a harder call. You set where automation acts, where it recommends, and how we verify what it did.

Automate the response path itself, not just the alerting. The measure is how much of an investigation is already done by the time a person opens it.

Bring threat intelligence into the practice with an output attached: adversary tradecraft translated into detection use cases, hunts, or control changes.

Advance the program's metrics: coverage against the threat model, escalation quality from the provider, time to detect and time to close, reported in terms leadership steers by.

Hunt on a schedule. Structured hypotheses against our own telemetry, and every finding either becomes a detection or gets written down as a deliberate gap.

What we're looking for

Required

Eight or more years in security operations, detection engineering, or incident response, with time spent leading incidents rather than only working them. Equivalent depth counts.

Detection engineering in a modern SIEM, with the query fluency to build and validate rules yourself. We run Microsoft Sentinel and Defender XDR.

Identity attack fluency. Entra ID and Active Directory attack paths, token and session abuse, OAuth consent, and federation.

Hands-on work with AI-assisted detection, triage, or investigation within the last six months, and a considered view on where automation should and shouldn't be trusted to act.

The three above are the bar. Everything below is depth we'd like and can build. If you meet the requirements and bring most of the rest, apply. We'd rather assess the gap ourselves than have you decide it for us.

Also matters: cloud detection across Azure and AWS control planes; scripting and automation in Python or PowerShell; managing or directing an MDR or managed SOC relationship; forensic investigation and evidence handling; writing that holds up when an executive or an auditor reads it.

Helpful: threat hunting from structured hypotheses; insider risk detection, container and Kubernetes runtime detection, SOAR or workflow automation platforms, threat intelligence work with an operational output, prior time on the engineering side.

What you should know going in

This is a practice to build, not a queue to work. The managed tier handles the volume, which leaves you the engineering and the judgment: what we detect, how well, and what happens next. You'll have functional direction of the SOC analysts, with people leadership held by the director, and direct access to engineering leadership. Your incident write-ups will be read at the executive level. If you want to own a detection and response practice rather than inherit someone else's rules, this is that seat.

Company Description

One Identity enables organizations of a