Detection and Response Lead

Triwill Group; United States; On-site; USD 140,000 - 210,000; Full time

Job summary

Triwill Group, via a partner company, seeks a Detection and Response Lead based in the United States. You will build and lead a technically deep detection and response capability across enterprise and cloud environments, owning investigations, incident response, threat hunting, and continuous improvement of defensive security operations.

You will work closely with security engineering and external MSSP/MDR partners, serving as the escalation point for complex events and driving incidents through

Qualifications

• Experience leading detection and response teams.
• Strong incident response and investigations capability.
• Familiarity with cloud security across AWS, Azure, and on-premise environments.

Responsibilities

• Lead and mature detection and response across enterprise and cloud environments.
• Own advanced investigations, containment, and remediation of security incidents.
• Develop repeatable playbooks and improve monitoring coverage.

Skills

Threat hunting

Incident response

Security operations

Cloud security (AWS/Azure)

Job description

Description:

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Detection and Response Lead based in the United States.

As Detection and Response Lead, you will build and lead a technically deep detection and response capability across enterprise and cloud environments. You will own advanced investigations, incident response, threat hunting, and continuous improvement of defensive security operations. Working closely with security engineering and external MSSP/MDR partners, you will serve as the escalation point for complex security events and drive incidents through investigation, containment, and remediation. The role combines hands‑on technical execution with operational leadership and close partnership with the CISO and senior stakeholders. You will strengthen detection quality, improve monitoring coverage, and develop repeatable response processes and playbooks. Your work will directly improve the organization’s ability to detect, understand, and contain sophisticated threats across AWS, Azure, endpoints, identities, and enterprise infrastructure.