Senior Manager Purple Team

Vanguard; Malvern (Chester County); Hybrid; USD 180,000 - 250,000; Full time

Job summary

Vanguard in Malvern is seeking a Senior Manager, Purple Team Operations to lead the Purple Team program within OSFT. You will build and scale threat-informed validation collaborating with Offensive Security, CSOC, Detection Engineering, and Fraud Detection to strengthen detection and response across the enterprise.

The role emphasizes strategic leadership, advanced MITRE framework knowledge, and driving measurable cyber resilience improvements.

Qualifications

• 10+ years of cybersecurity experience with strong Purple Team and defense validation expertise.
• Proven leadership of distributed security teams and programs.
• Deep knowledge of MITRE ATT&CK/ATLAS and threat-informed testing.
• Experience aligning offensive and defensive security activities.

Responsibilities

• Define and execute the strategic vision for Vanguard's Purple Team program.
• Lead a geographically distributed team of Purple Team operators.
• Oversee detection validation and threat-informed testing across the enterprise.
• Collaborate with Offensive Security, CSOC, Fraud Detection, and Threat Intelligence.
• Establish measurable security metrics and report to leadership.
• Drive remediation closure and program maturity.

Skills

Purple Teaming

Threat Hunting

Incident Response

Leadership

Program Management

Threat-informed Defense

Communication

Education

Bachelor's degree in Computer Science, Cybersecurity, or related discipline

Relevant certifications (e.g., CISSP, GCFA, OSCP)

Tools

SIEM

EDR

NDR

Cloud security monitoring

Automation frameworks

Job description

The Senior Manager, Purple Team Operations leads Vanguard's Purple Team program within the Offensive Security & Fraud Testing (OSFT) organization. This role is responsible for building and scaling a threat-informed validation program that partners Offensive Security, the CSOC, Detection Engineering, and Fraud Detection teams to continuously improve Vanguard's detection, response, and resilience capabilities. Unlike offensive security operations that primarily assess security readiness through covert adversary emulation, the Purple Team function focuses on collaborative validation of controls, detections, and response processes. The team's mission is to ensure that identified detection gaps are translated into measurable defensive improvements and that Vanguard can detect, investigate, and respond to relevant adversary behaviors across the enterprise. Success in this role is measured by the effectiveness of Vanguard's detection and response capabilities: improved detection coverage, reduced detection gaps, faster response times, stronger collaboration across offensive and defensive teams, and measurable improvements in cyber resilience.

Job Description

Key Responsibilities

• Purple Team Program Leadership: Define and execute the strategic vision for Vanguard's Purple Team program, aligning threat-informed defense validation activities to enterprise cyber risk priorities. Develop annual roadmaps that prioritize adversary emulation, detection validation, control effectiveness testing, and threat-informed exercises based on intelligence, prior offensive operations, and evolving industry threats.
• Team Management & Development: Lead and develop a geographically distributed team of Purple Team operators focused on adversary emulation, detection validation, and defensive capability improvement. Drive hiring, coaching, mentoring, and career development while fostering a culture of continuous learning, innovation, and collaboration between offensive and defensive security teams.
• Detection Validation & Threat-Informed Testing: Oversee Purple Team operations that validate security controls, detection content, response playbooks, and investigative procedures across the enterprise. Ensure testing is aligned to known adversary TTPs and frameworks such as MITRE ATT&CK and MITRE ATLAS. Drive repeatable validation methodologies that assess prevention, detection, investigation, and response capabilities.
• Offensive Security Partnership & Remediation Closure: Partner closely with Offensive Security teams to translate findings from Red Team operations, penetration tests, and adversarial AI assessments into Purple Team validation activities. Ensure previously identified detection gaps are remediated, tested, and validated before closure. Establish feedback loops that improve both offensive and defensive program effectiveness.
• CSOC & Detection Engineering Collaboration: Serve as the primary liaison between OSFT, CSOC, Threat Detection Engineering, Fraud Detection, and Cyber Threat Intelligence teams. Coordinate collaborative exercises that validate new detections, response workflows, telemetry coverage, and security monitoring capabilities. Drive alignment on adversary emulation priorities and detection engineering roadmaps.
• Reporting & Metrics: Establish measurable metrics to demonstrate security improvement and operational effectiveness. Track and communicate detection coverage, ATT&CK technique validation rates, mean-time-to-detect improvements, detection fidelity, response effectiveness, and remediation progress. Present findings, trends, and strategic recommendations to senior leadership and governance forums.
• Threat Intelligence Integration: Partner with Cyber Threat Intelligence teams to ensure Purple Team exercises emulate relevant financial industry adversaries, fraud threats, ransomware groups, insider threats, and emerging AI-enabled attack techniques. Translate intelligence into actionable validation scenarios that strengthen Vanguard's security posture.
• Strategic Innovation & Program Maturity: Continuously evolve the Purple Team capability by introducing new validation methodologies, automation, adversarial AI testing approaches, cloud-native security validation, attack-path simulation, and continuous control validation capabilities. Drive innovation while ensuring exercises remain aligned with business objectives and risk priorities.

Required Qualifications

• Purple Team & Detection Expertise: 10+ years of experience in cybersecurity with significant experience in Purple Teaming, Detection Engineering, Threat Hunting, Incident Response, Red Teaming, or Adversary Simulation. Deep understanding of attacker methodologies, detection technologies, security telemetry, and defensive operations.
• Leadership & Program Management: 3+ years leading security teams, Purple Team programs, Detection Engineering functions, Incident Response capabilities, or equivalent technical organizations. Demonstrated ability to develop teams, manage strategic initiatives, and deliver measurable cybersecurity outcomes across multiple stakeholders.
• Threat-Informed Defense Expertise: Strong knowledge of MITRE ATT&CK, MITRE ATLAS, adversary emulation methodologies, detection engineering practices, threat hunting frameworks, and modern SOC operations. Experience designing and executing threat-informed validation programs at enterprise scale.
• Security Operations & Detection Engineering Knowledge: Deep familiarity with SIEM, EDR, NDR, cloud security monitoring, threat intelligence platforms, deception technologies, automation workflows, and modern detection engineering practices. Experience evaluating detection coverage and improving security monitoring effectiveness.
• AI & Automation Familiarity: Experience leveraging AI/ML technologies, automation frameworks, and security analytics to enhance threat detection, adversary simulation, or security operations. Understanding of how generative AI impacts both attacker tradecraft and defensive capabilities.
• Cross-Functional Leadership & Communication: Exceptional communication and stakeholder management skills with the ability to influence technical teams, security leadership, and executive stakeholders. Proven experience driving collaboration across Offensive Security, CSOC, Fraud, Risk, Engineering, and Threat Intelligence teams.
• Education & Certifications: Bachelor's degree in Computer Science, Cybersecurity, or related discipline (or equivalent experience). Relevant certifications (e.g., CISSP, GCFA. GCTI, GMON, GCIA, CRTO, CARTP, OSCP, CREST Certifications) that demonstrate both offensive technical depth and security management knowledge are strongly preferred.

Special Factors

Sponsorship

Vanguard is not offering visa sponsorship for this position.

About Vanguard

At Vanguard, we don't just have a mission-we're on a mission. To work for the long-term financial wellbeing of our clients. To lead through product and services that transform our clients' lives. To learn and develop our skills as individuals and as a team. From Malvern to Melbourne, our mission drives us forward and inspires us to be our best.

How We Work

Vanguard has implemented a hybrid working model for the majority of our crew members, designed to capture the benefits of enhanced flexibility while enabling in-person learning, collaboration, and connection. We believe our mission-driven and highly collaborative culture is a critical enabler to support long-term client outcomes and enrich the employee experience.