AI-Driven Detection Engineering Lead

Capital One; Plano (TX); On-site; USD 179,000 - 205,000; Full time

Job summary

Capital One is seeking an Detection Engineer Manager to lead AI-driven detection and engineering initiatives in Cyber Security. This role focuses on building behavior-based detections, threat research, and endpoint coverage strategy within a risk-aware fintech environment.

You will steer detection architecture, mentor engineers, and collaborate with CSOC, Threat Intelligence, and Hunt teams to ensure robust monitoring and compliant documentation across endpoints.

Qualifications

• Bachelor's Degree.
• 5+ years in cybersecurity or IT.
• 4+ years evaluating or supporting cybersecurity capabilities.
• 4+ years with endpoint logs (Windows Event Logs, Sysmon, EDR).
• 2+ years with EDR platforms (CrowdStrike Falcon, SentinelOne, Defender).
• 1+ year ML or data science applied to security.

Responsibilities

• AI-driven detection and engineering leveraging ML and detection lifecycles.
• DaC leadership using CI/CD against the Cyber Detection Library.
• Behavioral detection design for adversary patterns and TTPs.
• Strategic architecture using MITRE ATT&CK to close gaps.
• Threat research translating attacker techniques into detections.
• Endpoint domain ownership from telemetry onboarding to tuning.
• Stakeholder and risk management with leaders and CSOC teams.
• Technical leadership and mentorship across the team.

Skills

Bachelor's Degree

5+ years cybersecurity

4+ years cybersecurity capabilities

4+ years endpoint logs

2+ years EDR experience

1+ year ML in security

Threat Detection / Security Eng

MITRE ATT&CK knowledge

Python

Security tools (Splunk/CrowdStrike/QA/

Education

Bachelor's Degree

Tools

CrowdStrike Falcon

SentinelOne

Microsoft Defender

Splunk

Qualys

AWS Security Hub

Job description

Capital One is seeking an Detection Engineer Manager to lead AI-driven detection and engineering initiatives in Cyber Security. This role focuses on building behavior-based detections, threat research, and endpoint coverage strategy within a risk-aware fintech environment.

You will steer detection architecture, mentor engineers, and collaborate with CSOC, Threat Intelligence, and Hunt teams to ensure robust monitoring and compliant documentation across endpoints.