Manager, Threat Intelligence

PDI Technologies, Inc.; United States; Hybrid; USD 180,000 - 230,000; Full time

Job summary

PDI Technologies, Inc. is seeking an experienced leader to own threat intelligence, threat hunting, and detection engineering for our SOC.

You'll build the clearest picture anywhere of who targets these industries and how, then turn it into detections, hunts, and guidance that protects 12,000+ customers. With a team of analysts, hunters, and detection engineers, you'll own the intel lifecycle, deliver actor profiles and industry briefs, and communicate with executives and customers.

Qualifications

• 8+ years in cybersecurity across threat intelligence, threat hunting, incident response, detection engineering, or security operations.
• 3+ years managing technical security teams, including hiring and developing people.
• Deep knowledge of adversary tactics and frameworks such as MITRE ATT&CK and the intelligence lifecycle.
• Track record of producing finished intelligence for technical and executive audiences.
• Hands-on with SIEM and EDR/XDR platforms and their query languages (KQL, SPL, or similar).
• Experience supporting complex investigations and incident response.
• Excellent written, verbal and presentation communication skills.
• Clear writing and speaking skills, translating findings into business risk.

Responsibilities

• Hire, coach, and develop a remote team of analysts, hunters, and detection engineers with clear priorities and career paths.
• With a team of four, split time between leading and hands-on hunting, writing intelligence, and building detections.
• Partner with SOC, Incident Response, and Security Engineering leaders to improve detection, response, and customer outcomes.
• Define intelligence requirements with SOC leadership and customers and run the full intelligence lifecycle from collection through feedback.
• Deliver strategic, operational, and tactical products: actor profiles, campaign analysis, industry threat briefs, and customer-specific reports.
• Track actors that matter to customers, including financially motivated groups, payment fraud operators, and ransomware crews targeting retail/hospitality.
• Own detection content strategy across SIEM and EDR/XDR, develop, test, tune, and align with MITRE ATT&CK.
• Run threat hunts across customer environments and feed findings back into new detections.
• Use automation and AI to scale enrichment, triage support, and reporting so the team can focus on analysis.
• Provide intelligence context during major incidents and lead during complex escalations.
• Be the voice of the team to customers through briefings, reports, and executive presentations.
• Run the team with metrics like detection coverage, hunt findings, reporting timeliness, and customer satisfaction.

Skills

Threat intelligence

Threat hunting

Incident response

Detection engineering

Security operations

SIEM

EDR/XDR

MITRE ATT&CK

Leadership

Communication

Education

Bachelor's degree in related field

Tools

FortiSIEM

Microsoft Sentinel

Splunk

Google Chronicle

Job description

At PDI Technologies, we empower some of the world's leading convenience retail and petroleum brands with cutting-edge technology solutions that drive growth and operational efficiency. By “Connecting Convenience” across the globe, we empower businesses to increase productivity, make more informed decisions, and engage faster with customers through loyalty programs, shopper insights, and unmatched real-time market intelligence via mobile applications, such as GasBuddy. We’re a global team committed to excellence, collaboration, and driving real impact. Explore our opportunities and become part of a company that values diversity, integrity, and growth.

Every day, millions of people buy fuel, coffee, and lunch at the businesses PDI protects. Convenience stores, fuel stations, quick-service restaurants, and automotive businesses run on payment systems, point-of-sale networks, and connected site equipment, and financially motivated attackers know it.

We're looking for an experienced leader to own threat intelligence, threat hunting, and detection engineering for our SOC. You'll build the clearest picture anywhere of who targets these industries and how, then turn it into detections, hunts, and guidance that protects 12,000+ customers.

This isn't an internal intel team serving one company. Your team's work ships to every customer we protect, and you'll have real room to build the program the way you think it should run.

Why this role stands out

• A threat landscape you can own. Payment card theft, POS malware, ransomware against franchise networks, and attacks on connected forecourt and in-store systems. Few teams anywhere specialize here
• A straight line from intel to impact. Your team writes the intelligence and the detections. You'll see your work stop real attacks across many customer environments
• Room to build. Shape the methodology, tooling, and AI-assisted workflows rather than inheriting someone else's playbook
• Visibility. Brief customer executives, partner with SOC, product, and company leaders, and represent PDI in industry and intelligence-sharing communities

What you'll own

Lead and grow the team

• Hire, coach, and develop a remote team of analysts, hunters, and detection engineers, with clear priorities and career paths
• With a team of four, you'll split your time between leading and doing: hunting, writing intelligence, and building detections alongside the team
• Partner with SOC, Incident Response, and Security Engineering leaders to improve detection, response, and customer outcomes

Build the intelligence program

• Define intelligence requirements with SOC leadership and customers and run the full intelligence lifecycle from collection through feedback
• Deliver strategic, operational, and tactical products: actor profiles, campaign analysis, industry threat briefs, and customer-specific reports
• Track the actors that matter most to our customers, including financially motivated groups, payment fraud operations, and ransomware crews targeting retail and hospitality

Turn intelligence into detection

• Own detection content strategy across SIEM and EDR/XDR, including development, testing, tuning, and coverage measured against MITRE ATT&CK
• Run hypothesis-driven threat hunts across customer environments and feed what you find back into new detections
• Use automation and AI to scale enrichment, triage support, and reporting so the team can focus on analysis, not busywork

Step in when it matters

• Provide intelligence context during major incidents and lead during complex escalations

Be the voice of the team

• Serve as a trusted advisor to customers through briefings, reports, and presentations for both technical and executive audiences
• Run the team on clear metrics such as detection coverage, hunt findings, reporting timeliness, and customer satisfaction, and contribute to service planning and new offerings

What success looks like

• First 90 days: Assess the team, tooling, and current detection coverage. Agree on intelligence requirements with SOC leadership and key customers
• By 6 months: A regular cadence of industry threat reporting, plus an ATT&CK coverage baseline and roadmap
• By 12 months: Measurable gains in detection coverage and hunt-driven findings, and a team customers see as the go-to source on threats to their industry

What you bring

Required

• 8+ years in cybersecurity across threat intelligence, threat hunting, incident response, detection engineering, or security operations
• 3+ years managing technical security teams, including hiring and developing people
• Deep knowledge of adversary tactics and the frameworks used to analyze them, such as MITRE ATT&CK, the intelligence lifecycle, and the Diamond Model
• A track record of producing finished intelligence for both technical and executive audiences
• Hands-on experience with SIEM (FortiSIEM, Microsoft Sentinel, Splunk, Google Chronicle, or ArcSight) and EDR/XDR platforms and their query languages (KQL, SPL, or similar). Our environment includes FortiSIEM; equivalent experience is welcome
• Experience supporting complex investigations and incident response
• Excellent written, verbal, and presentation communication skills
• Clear writing and speaking skills, with the ability to translate technical findings into business risk

Nice to have

• Experience at an MSSP or MDR provider serving many customers
• Background in retail, hospitality, or payments environments, including POS systems or PCI DSS
• Detection-as-code, Sigma, SOAR, or scripting (e.g., Python)
• Experience with threat intelligence platforms and feeds, such as MISP or Recorded Future
• Cloud and SaaS investigations across Azure, AWS, or Microsoft 365
• Active involvement in intelligence-sharing communities such as RH-ISAC
• Certifications such as GCTI, GCFA, GCIH, GREM, or CISSP are welcome but not required

A bachelor's degree in a related field or equivalent experience. If you're close on the requirements and excited about the work, we'd still like to hear from you.

PDI is committed to offering a well-rounded benefits program, designed to support and care for you, and your family throughout your life and career. This includes a competitive salary, market-competitive benefits, and a quarterly perks program. We encourage a good work-life balance with ample time off [time away] and, where appropriate, hybrid working arrangements. Employees have access to continuous learning, professional certifications, and leadership development opportunities. Our global culture fosters diversity, inclusion, and values authenticity, trust, curiosity, and diversity of thought, ensuring a supportive environment for all.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.