Manager Security Engineer, Operations

Fivetran, Inc.; Massachusetts; Hybrid; USD 180,000 - 260,000; Full time

Job summary

Fivetran is seeking a Manager of Security Operations, Incident Detection and Response to strengthen the platform and enterprise security. This hands-on, people-led role builds and leads a high-performing team, owns the detection and response stack, and serves as incident commander for major security events across endpoints, cloud, and production.

You will oversee detection engineering, AI-driven operations, multi-tenant SaaS security, tooling, and collaborate with Engineering, IT, and Legal to

Responsibilities

• Lead, mentor, and develop a detection and response team with clear goals and accountability.
• Define team structure, on-call rotations, and hiring plans to scale with the business.
• Own the incident response program for the entire enterprise, acting as incident commander for major events.
• Develop high-fidelity detections across cloud, identity, endpoint, SaaS, and applications.
• Drive AI-driven security operations to automate alert triage, enrichment, investigation, and response.
• Design detection and response for a multi-tenant SaaS platform, ensuring customer data protection.
• Own the security operations technology stack, including SIEM, SOAR, EDR/XDR, and log pipelines.
• Lead proactive threat hunting and integrate threat intelligence to mitigate emerging threats.
• Collaborate with Engineering, IT, and GRC to remediate risks across pipelines and environments.

Tools

Crowdstrike

Okta

Google Workspace

Wiz

Open Source

Notion

JIRA

Job description

From Fivetran's founding until now, our mission has remained the same: to make access to data as simple and reliable as electricity. With Fivetran, customer data arrives in their warehouses, canonical and ready to query, with no engineering or maintenance required. We're proud that more organizations continue to leverage our technology every day to become truly data-driven.

About Us

Fivetran and dbt Labs are bringing together two industry-leading companies with a shared mission: helping organizations unlock the full value of their data. Together, we're delivering the data infrastructure layer that helps organizations move, transform, and trust their data - from the moment data moves, through every transformation, to the context teams and AI systems rely on. Fivetran helps organizations automate data movement across the systems, clouds, engines, and tools they rely on. dbt Labs pioneered analytics engineering, helping teams transform data into reliable, governed insights. Together, we support thousands of organizations as they build a trusted foundation for analytics, AI, and better business decisions. As we bring our teams and technology together, we're building on the strengths of both companies while continuing to deliver the products and experiences our customers know and trust. It's an exciting time to join us: we're creating a company with the scale, talent, and technology to help more organizations put their data to work with greater speed, confidence, and impact. During this transition period, you may see references to both Fivetran and dbt Labs throughout our recruiting process as we integrate our teams, systems, and career sites.

About the Role

Fivetran + dbt is seeking a Manager of Security Operations, Incident Detection and Response, to bolster and improve the robustness and security of the platform and the entire enterprise. This people-leadership role is hands-on and execution-focused, requiring deep expertise in security operations, incident detection and response, AI-driven security automation, and securing multi-tenant SaaS environments. You'll build and lead a high-performing team, own the detection and response technology stack, and serve as the accountable leader for incident response across the entire enterprise, ensuring threats are detected, contained, and remediated quickly from endpoint to cloud to production.

This is a full-time remote position based out of the US (EST Time Zone).

Technologies You’ll Use

Crowdstrike, Okta, Google Workspace, Wiz, Open Source, Notion, JIRA

What You’ll Do

• People Leadership: Lead, mentor, and develop a team of detection and response engineers and analysts. Set clear goals, manage performance, and grow careers while fostering a culture of ownership, curiosity, and urgency.
• Hiring & Team Building: Recruit, hire, and onboard top security talent. Define team structure, roles, on-call rotations, and hiring plans to scale the team alongside the business.
• Enterprise Incident Response: Own the incident response program for the entire enterprise, including investigation, containment, eradication, remediation, and post-incident review. Act as incident commander for major security events and coordinate with Legal, Privacy, Communications, and executive leadership.
• Detection Engineering: Build, optimize, and maintain high-fidelity detections across cloud, identity, endpoint, SaaS, and application layers, using threat-informed approaches such as MITRE ATT&CK to close coverage gaps.
• AI-Driven Security Operations: Drive the adoption of AI, including LLMs and AI agents, to automate alert triage, enrichment, investigation, and response. Evaluate and integrate AI capabilities to scale the team, and build detections for threats targeting AI systems and AI usage across the enterprise.
• Multi-Tenant SaaS Security: Design detection and response strategies tailored to a multi-tenant SaaS platform, including tenant isolation, cross-tenant access, and customer data protection. Lead customer-impacting incident response and coordinate customer notifications.
• Security Technology Ownership: Own the security operations technology stack, including SIEM, SOAR, EDR/XDR, cloud detection and response, and log pipelines. Manage the roadmap, budget, and vendor relationships.
• Threat Hunting & Intelligence: Lead proactive threat hunting and integrate threat intelligence to identify and mitigate emerging threats before they impact the business.
• Cross-Team Collaboration: Work directly with engineering, infrastructure, IT, application security, and GRC teams to integrate detection and response practices and remediate risks across build pipelines, runtime environments, and corporate systems.
• Tooling & Automation: