Senior Director, Threat Management

ECOLAB; Saint Paul (MN); On-site; USD 180,000 - 300,000; Full time

Job summary

ECOLAB seeks a Senior Director of Threat Management to lead the enterprise detection and response program. You will own the SOC, CTI, detection engineering, and IR, ensuring rapid detection, triage, investigation, and containment across a global Fortune 500 environment.

You will oversee a 24x7 monitoring and response organization, advance the detection engineering pipeline, and drive measurable improvements in MTTD and MTTR while partnering with platform engineering for security tooling.

Qualifications

• Experience leading enterprise threat management programs.
• Proven ability to oversee SOC, CTI, and IR functions.
• Strong governance, metrics, and executive reporting skills.

Responsibilities

• Define and own enterprise threat detection strategy, roadmap and operating model.
• Lead 24x7 SOC with monitoring, triage, and initial investigation.
• Drive detection engineering, tooling, and data source onboarding.
• Operationalize threat intelligence and enable intelligence-led detection.
• Own incident response processes and post-incident reviews.
• Lead organizational leadership and cross-functional alignment.

Skills

Leadership

SOC Operations

Threat Detection

Incident Response

Governance

Tools

SIEM

SOAR

MITRE ATT&CK

Job description

Job Summary

The Senior Director of Threat Management is responsible for leading the enterprise detection and response function, owning the reactive side of security: identifying, investigating, and containing threats across a global Fortune 500 environment. This role provides leadership for the Security Operations Center (SOC), Cyber Threat Intelligence (CTI), Detection Engineering, and Incident Response (IR), and is accountable for the speed and quality of threat detection, triage, investigation, and response across the enterprise.

The Senior Director leads a 24x7 monitoring and response organization while advancing the detection engineering pipeline, maturing threat intelligence integration, and driving measurable improvement in mean time to detect and mean time to respond. The role combines strategic direction, operational accountability, and organizational leadership to reduce enterprise risk from active and emerging threats, partnering closely with the platform engineering team that owns the underlying security tooling.

What You Will Do

Strategy, Governance, and Leadership

• Define and own the enterprise threat detection and response strategy, roadmap, and operating model aligned to cybersecurity, risk, and business objectives.
• Mature the threat management program through formal governance, playbooks, standards, metrics, and leadership reporting.
• Present detection and response posture, incident trends, risks, and investment needs to security leadership and executive stakeholders.
• Establish and monitor KPIs such as mean time to detect (MTTD), mean time to respond (MTTR), detection coverage, and alert quality.
• Lead prioritization decisions across the SOC, threat intelligence, detection engineering, and incident response functions.

Security Operations and Monitoring

• Lead a 24x7 Security Operations Center responsible for monitoring, alert triage, escalation, and initial investigation across the enterprise.
• Own the detection content lifecycle within the SIEM, and define data source onboarding, log storage, and retention requirements for the platform‑owning team.
• Drive continuous improvement in alert quality, triage efficiency, and analyst workflow to reduce noise and analyst fatigue.
• Establish tiered operating models, shift coverage, and escalation paths that ensure consistent 24x7 response readiness.
• Oversee SOC performance metrics, service levels, and quality assurance across monitoring and triage activities.

Detection Engineering

• Lead the detection engineering function responsible for building, tuning, and maintaining detection content across SIEM and security telemetry sources.
• Drive a detection‑as‑code approach with version control, testing, peer review, and measurable detection coverage mapped to MITRE ATT&CK.
• Prioritize detection development against threat intelligence, red team findings, incident learnings, and emerging adversary techniques.
• Establish metrics for detection coverage, efficacy, and false‑positive rates, and drive continuous tuning based on outcomes.
• Partner with engineering and platform teams to ensure high‑quality, well‑structured log and telemetry sources feed detection pipelines.

Cyber Threat Intelligence

• Lead the Cyber Threat Intelligence function responsible for strategic, operational, and tactical intelligence supporting detection and response.
• Operationalize threat intelligence by driving indicator enrichment, threat actor tracking, and intelligence‑led detection and hunting priorities.
• Deliver executive and stakeholder threat briefings that translate the threat landscape into business‑relevant risk and action.
• Establish threat hunting programs that proactively search for adversary activity across the environment ahead of alerting.
• Manage intelligence sources, sharing partnerships, and integration of intelligence into SIEM, SOAR, and detection workflows.

Incident Response

• Own the enterprise incident response process across detection, triage, containment, eradication, recovery, and post‑incident review.
• Lead major incident coordination, serving as an escalation point and driving cross‑functional response during significant events.
• Establish and maintain incident response playbooks, runbooks, and tabletop exercises to ensure organizational readiness.
• Drive post‑incident reviews and lessons‑learned processes that feed detection improvements and control gaps back into the program.
• Partner with legal, communications, IT, and business stakeholders to ensure coordinated response and regulatory notification where required.

Tooling and Automation Requirements

• Define detection and response requirements, use cases, and priorities for the SIEM, SOAR, and log storage platforms owned and operated by the platform engineering team.
• Partner with the platform‑owning team to shape roadmap, data onboarding, retention, and automation priorities that serve detection and response needs.
• Specify SOAR automation use cases for triage, enrichment, and response, and validate that delivered automations meet analyst workflow requirements.
• Provide feedback on tooling performance, gaps, and integration needs to drive a unified, efficient analyst workflow across detection, intelligence, and response.
• Use modern tools including AI‑assisted workflows to accelerate investigation, analysis, documentation, and decision‑making across the team.

Organizational and People Leadership

• Lead and develop a distributed threat management organization consisting of managers, analysts, detection engineers, threat intelligence analysts, and incident responders.
• Build organizational clarity across the SOC, threat intelligence, detection engineering, and incident response functions.