The role involves leading and developing the Security Operations Detection Engineering and Incident Response functions to create a proactive, intelligence-driven security program that enhances threat detection, response, and overall security posture across cloud and infrastructure environments.
Key Responsibilities
Lead and mature Detection Engineering and CIDR functions for threat detection, response workflows, incident triage, and automation
Build and maintain a comprehensive detection inventory categorized by threat type, log source, MITRE mapping, and detection method
Drive continuous validation of detections through red team, purple team, and atomic testing
Own key SecOps metrics such as MTTD, MTTR, and alert quality to improve detection confidence
Oversee ingestion of telemetry data from AWS, Azure, SaaS, endpoint, and network into Splunk and SOAR pipelines
Automate and ensure incident response workflows are repeatable and outcome-focused
Lead post-incident reviews and root-cause analyses, tracking corrective actions to closure
Correlate threat intelligence, detection gaps, and hunt findings into prioritized roadmap updates
Drive detection-to-remediation loops by partnering with other security and infrastructure teams
Produce dashboards connecting technical posture to business risk and ownership metrics
Lead scenario-based tabletop exercises, detection drills, and incident simulations
Requirements
10 years in cybersecurity, including 5 years in detection, incident response, or SecOps leadership
Proven experience leading detection engineering and incident response teams at enterprise scale
Deep expertise with SIEM Splunk (preferred), SOAR Tines, XSOAR, and EDR CrowdStrike
Experience with cloud telemetry and detection including CloudTrail, GuardDuty, VPC flow
Knowledge of threat modeling, MITRE ATT&CK, and TTP-to-detection lifecycle
Experience with detection-as-code practices, version control, and CI/CD pipelines
Hands-on skills validating detections through replay, simulation, and log mining
Familiarity with frameworks such as CIS Controls, NIST 800-53, and SOC 2
Ability to translate complex security data into clear, executive-level insights
Proven cross-team collaboration with Infra, GRC, Product Security, and Application teams
Strong written and verbal communication skills with an emphasis on clarity and measurable outcomes
Work from the Santa Clara, CA office in compliance with company policies (mandatory physical presence)
Benefits & Perks
Salary range: 225,000 - 338,000 USD annually
Potential for incentive pay and equity
In-office work environment in Santa Clara, CA
Flexible time off
Wellness resources
Company-sponsored team events
Recognition as a Fortune's Best Large Workplace in the Bay Area
Recognition as a Fortune's Best Workplace for Millennials
Certification and training opportunities
Inclusive and diverse workplace culture
Ready to Apply?
Join Pure Storage and make an impact in renewable energy