Senior Cyber Threat Intelligence & Detection Leader

Synchrony; Chicago (IL); Hybrid; USD 170,000 - 290,000; Full time

Benefits offered by this job

Work-from-home option

Job summary

Synchrony in Chicago is seeking a Cyber Intelligence Leader to own CTI, detection engineering, and cyber hunt programs, translating threat signals into actionable intelligence and measurable detection improvements across the enterprise.

You will lead a team across SIEM/EDR detections, map MITRE ATT&CK to detections, and drive enterprise-wide hunting and tuning with executive reporting.

Qualifications

• Bachelor’s degree in computer science or equivalent required.
• 8–12+ years of cybersecurity experience with threat intelligence, threat hunting, and detection engineering.
• 3+ years leading teams or enterprise programs.
• Experience building detections in SIEM/EDR and partnering with SOC/IR.
• Strong knowledge of MITRE ATT&CK.
• Proficiency with security telemetry across endpoints, networks, cloud, and edge.
• Excellent written and verbal communication; ability to brief executives.
• Ability to travel as required.

Responsibilities

• Define intelligence requirements and collection plans focused on threats in financial services.
• Produce strategic, operational, and tactical intelligence (executive reporting, actor/campaign tracking).
• Translate intelligence into detections, hunt hypotheses, playbooks, and mitigations.
• Manage the intelligence lifecycle (collection → analysis → production → dissemination → feedback).
• Lead hypothesis-driven hunts mapped to MITRE ATT&CK.
• Coordinate hunts across endpoint, network, cloud, identity, and edge; document hunt playbooks.
• Escalate validated suspicious activity to Incident Response and support containment/remediation.
• Convert hunt findings into durable improvements: detections and data onboarding.
• Lead a detection engineering function and develop detection standards and tuning processes.
• Ensure detections are threat-informed, measurable, and aligned to JSOC workflow.
• Drive detection validation via purple-team/attack simulations and real incidents.
• Partner with SOC to improve alert fidelity and escalation guidance.
• Maintain detection backlog and release cadence; document changes for auditability.

Skills

Threat intelligence

Threat hunting

Detection engineering

Incident response

MITRE ATT&CK

Security telemetry

Executive briefing

Education

Bachelor’s degree in computer science or equivalent

Tools

SIEM

EDR

Job description

Synchrony in Chicago is seeking a Cyber Intelligence Leader to own CTI, detection engineering, and cyber hunt programs, translating threat signals into actionable intelligence and measurable detection improvements across the enterprise.

You will lead a team across SIEM/EDR detections, map MITRE ATT&CK to detections, and drive enterprise-wide hunting and tuning with executive reporting.