Director, Threat Detection & Incident Response

Harvey; San Francisco (CA); On-site; USD 280,000 - 385,000; Full time

Job summary

Harvey is building AI-native software for professional services. We’re seeking a Director of Detection and Response to lead a high-impact security team, shape our threat program, and translate risk into a scalable blueprint that protects customer data and supports rapid product development.

You'll partner with CISO, Engineering, IT, Legal and Customer Trust to design incident response, telemetry, and automation across cloud and on‑prem environments, while mentoring engineers and driving

Qualifications

• Experience building and leading Detection and Response teams in tech with complex systems.
• Strong incident response judgment during serious security events.
• Solid foundations in cloud, OS, networking, identity, and attacker tradecraft.
• Engineering approach to security ops, with detection platforms or automation experience.
• Ability to turn risk into strategy and lead through influence.

Responsibilities

• Build and lead the organization; hire engineers and establish ownership.
• Own incident response and crisis readiness with playbooks and 24/7 coverage.
• Define telemetry, detection pipelines, and automation across environments.
• Prioritize meaningful threats and coordinate cross-functional responses.
• Turn incidents into lasting improvements with blameless reviews and action ownership.
• Collaborate with stakeholders to ensure rapid, informed decision making.

Skills

Detection & Response leadership

Incident response leadership

Security engineering

Cloud infrastructure

Threat hunting

Digital forensics

Team building

Tools

Forensic tooling

Response automation

Job description

Harvey is building AI-native software for professional services. We’re seeking a Director of Detection and Response to lead a high-impact security team, shape our threat program, and translate risk into a scalable blueprint that protects customer data and supports rapid product development.

You'll partner with CISO, Engineering, IT, Legal and Customer Trust to design incident response, telemetry, and automation across cloud and on‑prem environments, while mentoring engineers and driving