Detection and Response Lead
One Identity
IndiaremotePosted 16 days ago
Skill Required
Detection-EngineerIncident-ResponseSecurity-OperationsCybersecuritySOC-AnalystDetection-and-Response-LeadIncident-Response-LeadDetection-And-Response-ManagerLead-Security-Incident-ResponderDetection-Engineering-ManagerLead-Threat-HunterandSOCIAMEngineeringKubernetesautomationShell ScriptingObservabilitysecuritybuildingwrittenPythonAzureOAuthCloudjQuerySIEMAWSAIFulltime
Key highlights
- Requires eight or more years of experience in security operations, detection engineering, or incident response with proven leading-incidents track record
- Needs detection engineering skills in Microsoft Sentinel and Defender XDR with ability to build and validate rules via queries
- Must possess cloud detection expertise across both Azure and AWS control planes
- Should have recent hands-on experience (within six months) with AI-assisted detection, triage, or investigation
Role overview
Detection and Response Lead at One Identity is a senior individual contributor position reporting to the Director of Information Security. This role leads the detection and response practice for a company building software that controls access to customer environments. The organization is separating from Quest Software to form an independent security function, operating with a lean, globally distributed team. The role focuses on ownership of detection strategies, signal quality management, telemetry standards, incident response lifecycle, and scaling automated workflows. It involves directing a managed provider, conducting tabletop exercises, collaborating with product security, and ensuring incident documentation meets executive and audit standards.
Responsibilities
- Own what gets detected by setting strategy for detection use cases and maintaining a catalog covering identity and authentication abuse, privileged access misuse, cloud control plane activity across Azure and AWS, endpoint and email vectors, and internal product deployment paths
- Treat detections as code by versioning, reviewing, testing against real telemetry, and tracking coverage against a threat model rather than vendor rule counts
- Own the signal quality problem end to end by tuning noisy signals, retiring dead detections, and identifying deliberate gaps
- Set the telemetry standard by deciding what to collect and retain for proper incident investigation and making the case for associated costs
- Lead incident response from escalation through closure including scoping, containment, evidence handling, root cause analysis, and final write-up
- Direct the managed provider by establishing escalation criteria, enforcing quality bars on incoming data, and closing loops on missed detections
- Run tabletop exercises with engineering and leadership to ensure on-call decision-making clarity under pressure
- Collaborate with product security on incidents involving shipped products, balancing internal detection and customer-facing disclosure
- Make the detection and response program scalable by determining where agentic workflows belong, automating response paths, integrating threat intelligence, and advancing program metrics
- Conduct scheduled hunts using structured hypotheses against internal telemetry, converting findings into detections or documented gaps
Requirements
- Eight or more years in security operations, detection engineering, or incident response with significant time leading incidents
- Detection engineering expertise in a modern SIEM platform (Microsoft Sentinel and Defender XDR) with query fluency to build and validate rules independently
- Strong identity attack fluency including Entra ID and Active Directory attack paths, token and session abuse, OAuth consent, and federation
- Hands-on experience with AI-assisted detection, triage, or investigation within the last six months along with a considered view on automation trust boundaries
- Proficiency in cloud detection across Azure and AWS control planes
- Scripting and automation skills in Python or PowerShell
- Experience managing or directing an MDR or managed SOC relationship
- Forensic investigation and evidence handling capabilities
- Ability to write incident reports that withstand executive and auditor review
Nice to have
- Threat hunting conducted from structured hypotheses against internal telemetry
- Insider risk detection capabilities
- Container and Kubernetes runtime detection expertise
- SOAR or workflow automation platform experience
- Operational output from threat intelligence work
- Prior engineering experience
Additional details
- Role is based in India and reports directly to the Director of Information Security
- The organization is transitioning from Quest Software to build an independent security function with a lean global team
- 24/7 monitoring is handled by a managed provider (MDR/SOC) which escalates when needed
- Incident write-ups are intended to be reviewed at the executive level
- Health and wellness is prioritized as part of the company culture