Endpoint Detection Engineering Manager

Capital One National Association; Richmond (TX); On-site; USD 179,000 - 226,000; Full time

Benefits offered by this job

Performance-based incentives

Capital One benefits package

Job summary

Capital One's Cyber Organization seeks a Manager-level Detection Engineer to own end-to-end endpoint detection, leveraging AI-enabled workflows and Detection-as-Code within a fast-paced environment. You will influence detection strategies, guide engineers, and drive improved security outcomes across the enterprise.

The role requires deep expertise in endpoint telemetry, EDR platforms, and threat detection, with collaboration across CSOC, Threat Intelligence, and audit teams.

Qualifications

• High School Diploma, GED, or equivalent certification.
• At least 4 years of experience working in cybersecurity or information technology.
• At least 4 years of experience with endpoint and host logs (Windows Event Logs, Sysmon, EDR telemetry).
• At least 2 years of experience with EDR platforms (CrowdStrike Falcon, SentinelOne, Microsoft Defender).
• At least 4 years of experience developing alerts for threat detection.
• At least 2 years of experience with penetration testing, offensive security, or adversary emulation.
• At least 1 year of experience with machine learning or data science applied to security.

Responsibilities

• AI-Driven Detection & Engineering: Leverage ML to automate detection logic and accelerate the detection lifecycle.
• Detection-as-Code (DaC) Leadership: Design and maintain rules using DaC with CI/CD pipelines.
• Behavioral Detection Engineering: Build high-fidelity behavioral detections using telemetry and correlation logic.
• Strategic Architecture: Use MITRE ATT&CK to visualize and close endpoint coverage gaps.
• Offensive Alignment & Threat Research: Translate attacker techniques into detections and identify gaps.
• Endpoint Domain Ownership: Manage end-to-end detection coverage for the Endpoint surface.
• Stakeholder & Risk Management: Collaborate with CSOC, Threat Intelligence, and Audit teams.
• Technical Leadership & Mentorship: Mentor engineers and promote best practices.

Skills

Endpoint security

EDR platforms

Telemetry analysis

SQL queries

Threat detection

Python

CI/CD pipelines

Machine learning in security

Education

Bachelor's Degree

High School Diploma

Tools

CrowdStrike Falcon

SentinelOne

Microsoft Defender

Job description

Capital One's Cyber Organization seeks a Manager-level Detection Engineer to own end-to-end endpoint detection, leveraging AI-enabled workflows and Detection-as-Code within a fast-paced environment. You will influence detection strategies, guide engineers, and drive improved security outcomes across the enterprise.

The role requires deep expertise in endpoint telemetry, EDR platforms, and threat detection, with collaboration across CSOC, Threat Intelligence, and audit teams.