Endpoint Detection Engineering Manager (AI‑Driven)

Information Technology Senior Management Forum; McLean (VA); On-site; USD 197,000 - 225,000; Full time

Job summary

Capital One is seeking a Detection Engineer, Manager, to own end‑to‑end endpoint detection coverage and lead a team in building high‑fidelity detections. The role emphasizes AI‑driven engineering, Detection‑as‑Code leadership, and strong collaboration with CSOC, Threat Intelligence, and Hunt teams.

You will mentor engineers, apply MITRE ATT&CK to prioritize coverage, and drive detections across Windows, Linux, and macOS telemetry at scale.

Qualifications

• Deep expertise in endpoint security, EDR platforms, and telemetry analysis across Windows, Linux, and macOS.
• Experience on a detection engineering, threat detection, or detection operations team focusing on endpoints.
• Strong SQL and data querying skills at scale.
• Understanding attacker TTPs and translating offensive insights into detections.
• Experience applying ML or data science concepts to security use cases.

Responsibilities

• AI‑driven detection and engineering to automate detection logic and reduce false positives.
• Lead Detection‑as‑Code design and CI/CD pipelines for detections.
• Build high‑fidelity behavioral detections and correlate endpoint signals.
• Visualize and prioritize using MITRE ATT&CK to close coverage gaps.
• Translate attacker techniques into high‑fidelity detections and identify gaps.
• Own end‑to‑end endpoint detection coverage from telemetry onboarding to alert deployment.
• Partner with CSOC, Threat Intelligence, and Hunt teams for monitoring and compliance.
• Mentor engineers and promote AI‑driven workflows and best practices.

Skills

Endpoint security

EDR platforms

Windows telemetry

Linux telemetry

macOS telemetry

SQL & data querying

TTPs & Red Team knowledge

ML / data science in security

Education

Bachelor’s Degree

Tools

CrowdStrike Falcon

SentinelOne

Microsoft Defender

Job description

Capital One is seeking a Detection Engineer, Manager, to own end‑to‑end endpoint detection coverage and lead a team in building high‑fidelity detections. The role emphasizes AI‑driven engineering, Detection‑as‑Code leadership, and strong collaboration with CSOC, Threat Intelligence, and Hunt teams.

You will mentor engineers, apply MITRE ATT&CK to prioritize coverage, and drive detections across Windows, Linux, and macOS telemetry at scale.