Threat Detection Engineering Lead

Vanguard; Malvern (Chester County); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Vanguard is seeking a Manager, Threat Detection Engineering in Malvern to lead a team of threat detection engineers, shaping the CSOC strategy and driving high-fidelity detections across the security stack.

You will own the detection engineering roadmap, champion detection-as-code, and collaborate with Threat Hunting, Adversary Emulation, and Incident Management to translate adversary behaviors into scalable detections. The role demands strong leadership and technical depth.

Qualifications

• Bachelor's degree in cybersecurity, information technology, or related field.
• 7+ years in security operations, threat detection, or related roles.
• Proven people management or team leadership experience in security engineering.
• Hands-on experience tuning detections in SIEMs and with SOAR.

Responsibilities

• Lead and develop a team of threat detection engineers.
• Define and own the detection engineering roadmap aligned to CSOC strategy.
• Drive MITRE ATT&CK coverage and detection-as-code practices.
• Oversee delivery of detection content across SIEM, EDR, CNAPP, ITP, NIDS/NIPS, and SaaS security.
• Coordinate with Threat Hunting, Adversary Emulation, Threat Intelligence, and Incident Management teams.
• Drive automation with SOAR, CI/CD, and AI-assisted tooling.
• Define and report on detection metrics (coverage, MTTD, false positives).

Skills

SIEM tuning

SOAR automation

EDR familiarity

MITRE ATT&CK

Threat detection program leadership

Detection engineering

CI/CD pipelines

Threat hunting collaboration

Education

Bachelor's degree in cybersecurity / IT

Tools

SOAR platforms

SIEM platforms

EDR platforms

CI/CD tooling

Job description

Vanguard is seeking a Manager, Threat Detection Engineering in Malvern to lead a team of threat detection engineers, shaping the CSOC strategy and driving high-fidelity detections across the security stack.

You will own the detection engineering roadmap, champion detection-as-code, and collaborate with Threat Hunting, Adversary Emulation, and Incident Management to translate adversary behaviors into scalable detections. The role demands strong leadership and technical depth.