Team Lead, Threat Detection & Incident Response (TDIR)

Lear Corporation; Southfield (MI); Vor Ort; USD 120.000 - 160.000; Vollzeit

Zusammenfassung

Lear Corporation in Southfield, MI seeks an experienced Team Lead to guide our Threat Detection & Incident Response (TDIR) team. This hands-on leadership role will mentor across three regions, own platform health, and manage vendor relationships within a 24/7 MSSP framework.

You will oversee IR processes, runbooks, and detections, ensuring effective incident handling and escalation. Strong cross-region communication is essential.

Qualifikationen

• 7+ years in security operations, incident response, threat detection or digital forensics.
• 2+ years leading or mentoring others (team lead, shift lead, senior analyst with mentoring responsibility).
• Hands-on incident response across endpoint, identity, email and cloud environments.

Aufgaben

• Act as the primary technical escalation point for complex investigations, guiding engineers on where to look, what to collect and whom to engage.
• Lead or coordinate response to significant security incidents, including containment, eradication, recovery, stakeholder communication and post-incident reviews.
• Define, maintain and improve IR processes, playbooks and runbooks aligned with frameworks such as NIST SP 800-61 and MITRE ATT&CK.
• Communicate process changes clearly across regions and ensure procedures are followed during incidents.
• Track and report operational metrics (e.g., MTTD/MTTR, escalation quality, detection coverage) and recommend improvements.
• Own the health, adoption and continuous tuning of the team's security platforms (EDR, SIEM, email security, threat intelligence, and related tooling).
• Keep detections and configurations current with emerging threats; manage upgrades, integrations and use‑case roadmaps.
• Ensure platforms are properly documented and that knowledge is shared across the team to avoid single points of failure.
• Serve as a primary point of contact for the MSSP and key security vendors, ensuring services meet agreed SLAs and organizational expectations.
• Participate in Quarterly Business Reviews (QBRs), product reviews and service improvement plans, and drive resulting action items through completion.

Kenntnisse

Security operations

Incident response

Threat detection

Digital forensics

Team leadership

MITRE ATT&CK

Communication

Global collaboration

Tools

EDR

SIEM

Jobbeschreibung

Select how often (in days) to receive an alert:

Team Lead, Threat Detection & Incident Response (TDIR)

Location: Southfield, MI, US, 48033

Country/Region: United States

Job Function: Information Technology

Requisition ID: 50073

Lear For You

We work hard for the people who work for us. We champion our teams and foster collaboration, inclusion, respect and excellence. Because we want to be more for you.

A path to a better career. A better future.

Our teams have invented groundbreaking technologies, manufactured millions of products and earned a long list of awards. Year after year, we’re named one of the World’s Most Admired Companies.

They’re the secret to our success—empowered, inventive and inclusive. Passionate about their craft. Driven to succeed. Because we win together.

Are you ready for a better career? A better future?

Job Description

We are looking for an experienced Team Lead to help guide our global Threat Detection & Incident Response (TDIR) team. The team is a Tier 2+ function that handles escalations from our 24/7 Managed Security Services Provider (MSSP), leads incident response, performs digital forensics, conducts cyber threat intelligence analysis, and owns the security platforms that power our detection program. This is a hands‑on leadership role. You'll be the team's go-to technical and process escalation point, mentor team members across three regions, run key team rhythms, and take ownership of platform health and vendor relationships. You'll work closely with the TDIR Manager and play a central part in how the team operates, grows and scales.

Responsibilities

• Act as the primary technical escalation point for complex investigations, guiding engineers on where to look, what to collect and whom to engage.
• Lead or coordinate response to significant security incidents, including containment, eradication, recovery, stakeholder communication and post-incident reviews.
• Define, maintain and improve IR processes, playbooks and runbooks aligned with frameworks such as NIST SP 800-61 and MITRE ATT&CK.
• Communicate process changes clearly across regions and ensure procedures are followed during incidents.
• Track and report operational metrics (e.g., MTTD/MTTR, escalation quality, detection coverage) and recommend improvements.
• Own the health, adoption and continuous tuning of the team's security platforms (EDR, SIEM, email security, threat intelligence, and related tooling).
• Keep detections and configurations current with emerging threats; manage upgrades, integrations and use‑case roadmaps.
• Ensure platforms are properly documented and that knowledge is shared across the team to avoid single points of failure.
• Serve as a primary point of contact for the MSSP and key security vendors, ensuring services meet agreed SLAs and organizational expectations.
• Participate in Quarterly Business Reviews (QBRs), product reviews and service improvement plans, and drive resulting action items through completion.

Your Qualifications

• 7+ years of experience in security operations, incident response, threat detection or digital forensics.
• 2+ years leading or mentoring others (team lead, shift lead, senior analyst with formal mentoring responsibility, or similar).
• Deep, hands‑on incident response experience across endpoint, identity, email and cloud environments.
• Strong working knowledge of EDR and SIEM platforms, including writing queries and detections.
• Experience working with or overseeing an MSSP/MDR provider.
• Solid understanding of MITRE ATT&CK, the IR lifecycle and the application of threat intelligence to detection and response.
• Excellent written and verbal communication, with the ability to brief both technical teams and leadership.
• Comfortable working with a global team and occasionally adjusting hours to support other time zones and active incidents.

Bonus If You Have

• Experience in manufacturing, automotive or other large, global enterprise environments, including OT exposure.
• Scripting/automation skills (PowerShell, Python) and SOAR experience.
• Experience managing vendor relationships, SLAs and QBRs.
• Experience building playbooks, training programs or analyst development plans.

Experience with Any of the Following Is a Strong Plus

• EDR / XDR: CrowdStrike Falcon (Insight, Spotlight and Identity)
• Email Security: Proofpoint
• Threat Intelligence: Recorded Future
• MDR Model: 24/7 MSSP Level 1 triage with in‑house Tier 2+ response

Certifications – Preferred, Not Required

• GIAC: GCIH, GCFA, GCIA, GCTI or GNFA
• CISSP or CISM
• CompTIA CySA+ / CASP+

Equal Opportunity Employer

Lear Corporation is committed to fair, merit‑based employment practices and equal opportunity.