Contract -Program & Product Management

Deloitte (UK); Alabama; On-site; USD 148,000 - 203,000; Full time

Job summary

Deloitte is seeking a senior Detection Engineering Programme Manager on a contract basis to own the end-to-end lifecycle, from ideation through deployment, across cross-functional teams in cybersecurity and AI monitoring.

You will define governance, maintain backlogs, track KPIs, and report to senior stakeholders, aligning with MITRE ATT&CK mappings and detection-as-code practices. This role involves close collaboration with SOC, data platforms, cloud teams, and business sponsors.

Qualifications

• 7+ years in programme or project management, with at least 3+ years embedded within cybersecurity, SOC, or detection engineering functions.
• Strong understanding of the detection engineering lifecycle, including use case development, SIEM rule authoring, alert tuning, and validation.
• Familiarity with detection-as-code practices and platforms (e.g., Splunk, Microsoft Sentinel, Chronicle, Elastic SIEM).
• Working knowledge of MITRE ATT&CK and its application to detection coverage mapping and gap analysis.

Responsibilities

• Own and manage the end-to-end detection engineering lifecycle — from use case ideation, requirements gathering, and prioritization through to development, validation, deployment, and tuning.
• Maintain and manage a structured detection use case backlog, ensuring alignment with SOC priorities and evolving threat landscapes.
• Define and enforce programme governance standards, including intake processes, milestone tracking, and delivery cadences across detection engineering workstreams.
• Produce and communicate programme status reports, risk registers, and delivery roadmaps for senior stakeholders and leadership.
• Track AI system monitoring use cases, including model abuse, prompt injection, data exfiltration, and anomalous pipeline activity, collaborating with AI/ML teams to translate threat models.
• Coordinate with security, data/platform, cloud, and business teams to ensure cross-functional alignment and timely delivery.

Skills

Programme management

Cybersecurity

Detection engineering

MITRE ATT&CK

AI/ML security

Stakeholder management

Agile / SAFe

Education

Bachelor's degree in Computer Science, Information Security, Business, or related field

Tools

Jira

Confluence

ServiceNow

Smartsheet

Job description

Contract Start Date: November 2026 or asap

Day Rate: Competitive (Inside IR35)

Working with the Deloitte Associate (Contractor) Programme means we can offer you the opportunity to work on a variation of industry and client related projects. Our aim is to retain the best talent and so when your project end date nears our team of Talent Community Advisors will be working with you to look at alternative projects within the firm that suit your experience should you wish to continue with Deloitte.

Skills

• BFT CyberTech: BRD process management.

Key Responsibilities

Detection Engineering Programme Management

• Own and manage the end-to-end detection engineering lifecycle — from use case ideation, requirements gathering, and prioritization through to development, validation, deployment, and tuning.
• Maintain and manage a structured detection use case backlog, ensuring alignment with SOC operational priorities and emerging threat landscapes.
• Define and enforce programme governance standards, including intake processes, milestone tracking, and delivery cadences across detection engineering workstreams.
• Produce and communicate programme status reports, risk registers, and delivery roadmaps for senior stakeholders and leadership.

AI System Monitoring Use Cases

• Drive the identification, scoping, and delivery of detection use cases specifically targeting AI system behaviours, including model abuse, prompt injection, data exfiltration via AI interfaces, and anomalous AI pipeline activity.
• Collaborate with AI/ML engineering, data science, and security teams to translate AI-specific threat models into actionable detection requirements.
• Track the maturity and coverage of AI-focused detections, ensuring continuous improvement against evolving AI threat vectors.

Cross-Functional Stakeholder Management

• Act as the primary programme interface between detection engineering teams, SOC operations, threat intelligence, data platform, cloud engineering, and business stakeholders.
• Facilitate and lead cross-functional planning sessions, working groups, and steering committees to align priorities and resolve blockers.
• Manage dependencies, risks, and interdependencies across multiple concurrent detection engineering workstreams and teams.
• Build and maintain strong stakeholder relationships to ensure programme transparency, buy-in, and accountability.

Process & Operational Excellence

• Design and implement scalable programme management frameworks, workflows, and tooling to support detection engineering at enterprise scale.
• Drive adoption of structured detection engineering methodologies (e.g., detection-as-code, use case tiering, coverage mapping to MITRE ATT&CK).
• Establish and track KPIs and OKRs for detection engineering programme health, delivery velocity, and SOC impact.
• Continuously identify and implement process improvements to reduce cycle time and improve detection quality.

Documentation & Reporting

• Maintain comprehensive programme documentation including use case catalogues, decision logs, RACI matrices, and delivery plans.
• Develop executive-level reporting and narrative updates to communicate programme progress, risks, and strategic value.

Required Skills & Experience

Experience

• 7+ years in programme or project management, with at least 3+ years embedded within or directly supporting cybersecurity, SOC, or detection engineering functions.

Detection Engineering Lifecycle

• Strong understanding of the detection engineering lifecycle, including use case development, SIEM rule authoring, alert tuning, and detection validation.
• Familiarity with detection-as-code practices and platforms (e.g., Splunk, Microsoft Sentinel, Chronicle, Elastic SIEM).
• Working knowledge of MITRE ATT&CK framework and its application to detection coverage mapping and gap analysis.

AI & Emerging Threat Domains

• Experience supporting or managing security programmes that address AI/ML system monitoring, GenAI risk, or emerging technology threat vectors.
• Familiarity with AI-specific threat models and the unique detection challenges posed by LLMs, AI pipelines, and model serving infrastructure.
• Proven ability to manage complex, multi-workstream programmes across cross-functional teams in matrixed organizations.
• Strong command of programme management methodologies (Agile, SAFe, Waterfall, or hybrid) and tooling (e.g., Jira, Confluence, ServiceNow, Smartsheet).
• Demonstrated experience managing senior stakeholder relationships and communicating programme status at executive level.

Cross-Functional Collaboration

• Track record of successfully coordinating across diverse teams including security engineering, data/platform engineering, threat intelligence, and business stakeholders.
• Strong facilitation skills for workshops, planning sessions, and working group governance.

Soft Skills

• Exceptional written and verbal communication skills with the ability to translate complex technical concepts for non-technical audiences.
• Strong organizational skills with a detail-oriented approach to risk, dependency, and issue management.
• Ability to operate effectively in ambiguous, fast-moving environments with competing priorities.
• Certifications (Preferred but not required): PMP, PgMP, SAFe Agilist, CISSP (Associate), or equivalent cybersecurity or programme management credentials.
• Education
• A Bachelor's degree in Computer Science, Information Security, Business, or a related field is required, or equivalent professional experience.

IR35

As a means of managing tax, commercial and reputational risks, Deloitte prohibits the use of Associates through Personal Service Companies ('PSCs'). All Associates must contract under PAYE arrangements through a Deloitte approved 'Employment Company' (aka 'umbrella company.').