Manager, Cyber Threat Intelligence & Response

MLB (Job Board Only); United States; On-site; USD 105,000 - 135,000; Full time

Benefits offered by this job

Competitive benefits

401K Contribution

Paid Time Off

Free MLB tickets

Training & development

Tuition reimbursement

Disability benefits

Life Insurance

Pet Insurance

Job summary

Major League Baseball is seeking a Manager, Cyber Threat Intelligence & Response to lead threat intelligence, incident response, and security awareness programs across MLB offices, the 30 Clubs, and affiliates.

The role oversees vulnerability intelligence, OSINT research, detection content development, incident coordination, and post-incident reviews, with focus on automation and faster triage/reporting cycles.

Responsibilities

• Own vulnerability intelligence program and assess real-world risk across MLB environments
• Set remediation priorities for the vSOC, Clubs, and internal Technology teams
• Lead threat hunting across endpoints, identity, cloud, network, and email
• Coordinate incident response from triage to closure and post-incident reviews
• Develop and lead security awareness training and phishing simulations

Job description

Major League Baseball is looking for a Manager, Cyber Threat Intelligence & Response to lead MLB's threat intelligence and incident response programs across the League office, the 30 Clubs, and their affiliates. The role manages vulnerability and exploit intelligence, digital risk monitoring, incident coordination, forensic investigation, threat hunting, and the use of intelligence in vSOC detection and response. The manager also owns security awareness programming and uses automation to shorten research, triage, and reporting cycles.

Responsibilities

• Own MLB's vulnerability intelligence program. Monitor newly disclosed vulnerabilities, exploit code, proof-of-concept availability, and threat actor weaponization to assess real-world risk across MLB environments
• Combine severity, exploit intelligence, asset context, and active targeting to set remediation priorities for the vSOC, Clubs, and internal Technology teams
• Direct research across OSINT, social media, deep and dark web sources, commercial intelligence platforms, and industry information-sharing groups
• Track threat actors, campaigns, indicators of compromise, and tactics, techniques, and procedures. Maintain documentation that the vSOC can use during investigations, threat modeling, and response
• Track and report threat intelligence, vulnerability, and response measures, including time to detect, time to contain, time to recover, incident recurrence, playbook use, and corrective action closure
• Support investigations involving credential exposure, phishing infrastructure, impersonation, fraudulent domains, executive targeting, brand abuse, and other external threats. Coordinate takedown or disruption work when needed

Detection Engineering and Threat Hunting

• Build and improve automation for vulnerability research, intelligence enrichment, alert correlation, investigation support, and reporting
• Convert threat and vulnerability intelligence into detection content, alert logic, hunt hypotheses, and tuning recommendations using Sigma, YARA, SIEM queries, EDR logic, and detection-as-code practices where appropriate
• Develop and lead hypothesis-driven threat hunts across endpoint, identity, cloud, network, email, and application telemetry
• Use threat and vulnerability intelligence to validate vSOC alerts, support containment decisions, reduce false positives, and identify gaps in detection coverage

Incident Response

• Support the incident response lifecycle, including triage, severity assessment, escalation, containment, eradication, recovery, and closure
• Set intelligence priorities and collection requirements for cyber threat intelligence, digital risk protection, social media monitoring, and vulnerability research
• Serve as incident commander when on-call for security events and lead incident bridges involving the vSOC, Clubs, Legal, Privacy, Communications, Technology, and other stakeholders
• Exercise delegated authority to direct containment, recovery, forensic response, and cross-functional incident coordination
• Lead post-incident reviews, document findings, update playbooks and controls, and track corrective actions through completion

Security Awareness and Incident Readiness

• Lead analysts, contractors, vSOC partners, and external security providers supporting intelligence and response operations
• Own MLB's security awareness strategy, including training, education, and phishing simulations based on current attacker methods and observed risk
• Plan and lead League-wide, Club, and internal tabletop exercises to test incident response plans, escalation procedures, communications, and playbooks
• Develop and maintain incident response plans, escalation paths, procedures, and playbooks for endpoint, identity, cloud, email, third-party, ransomware, and business email compromise scenarios

Qualifications & Skills

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Criminal Justice, Criminology, Law, or a related field, or equivalent practical experience
• Strong knowledge of threat actors, campaigns, indicators of compromise, tactics, techniques, and procedures, including practical use of the MITRE ATT&CK framework
• Working knowledge of AWS or GCP and scripting, detection, or query languages such as PowerShell, Python, SQL, KQL, SPL, Sigma, or YARA
• Experience in cyber threat intelligence, incident response, security operations, digital forensics, or a related security role
• Experience leading security incidents through triage, escalation, containment, eradication, recovery, and post-incident review
• Experience developing and running threat hunts across endpoint, identity, cloud, network, email, or application data
• Experience designing or delivering security awareness training and phishing simulation programs is a plus
• Experience developing or tuning detection content using SIEM queries, EDR logic, Sigma, YARA, or detection-as-code practices
• Hands-on experience with EDR/XDR, SIEM, and vulnerability assessment platforms
• Experience using OSINT, social media sources, deep and dark web monitoring, and commercial threat intelligence platforms
• Experience with security automation and orchestration (SOAR) platforms, including building workflows for threat intel research, enrichment, correlation, and reporting
• Strong documentation and communication skills, including the ability to explain attack methods, response decisions, and risk to technical and non-technical audiences
• Ability to handle sensitive information and participate in a rotational after-hours on-call and incident escalation schedule

Preferred Certifications

• CompTIA Cybersecurity Analyst (CySA+)
• CompTIA Certified Threat Intelligence Analyst (CTIA)
• SANS GIAC Cyber Threat Intelligence (GCTI)

Salary Range: $105,000 - $135,000 (Base Salary) + Bonus

As a candidate for this position, your salary and related aspects of compensation will be contingent upon your work experience, education, skills, and any other factors MLB considers relevant to the hiring decision. In addition to your salary, MLB believes in providing a competitive compensation and benefits package for its employees.

Top MLB Perks & Benefits

• Competitive Benefits Package
• Company 401K Contribution
• Paid Time Off and Holidays
• Paid Parental Leave
• Access to Free Tickets to Baseball Games & MLB.TV
• Discounts at MLB Store | MLBShop.com
• Employee Assistance Programs (EAP)
• Onsite/Online Training & Development Programs
• Tuition Reimbursement
• Disability Benefits (short term and long term)
• Life and Accidental Death Insurance
• Pet Insurance

Why MLB?

Major League Baseball (MLB) is the most historic of the major professional sports leagues in the United States and Canada. Employees love working at MLB because of the culture of growth, teamwork, and professionalism. Employees who are most successful at MLB take initiative, know how to identify problems and provide solutions, and always put the Team first. For those ready to step up to the plate and join the major leagues, MLB takes the same approach as teams do with their players: empowering our “workforce athletes” to be at their best by engineering experiences that put employees in the best position to succeed. Major League Baseball is looking for candidates who are passionate about growing America’s pastime to best serve its fans for decades to come.

California Residents: Please see our California Recruitment Privacy Policy for more details.

Colorado Residents: Colorado based applicants may redact or remove age-identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information.

Applicants requiring a reasonable accommodation for any part of the application and hiring process, please email us at [e-mail]. Requests received for non-disability related issues, such as following up on an application, will not receive a response.