Senior Security Operations Manager, Detection Engineering Incident Response

Pure Storage

Santa Clara, California

Full Time

Posted May 6, 2026

$225k - $338k

Not Specified

~18 people viewed this recently

Apply Now

Application opens on company website

Job Description

The Senior Manager of Security Operations Detection Engineering and Incident Response leads and develops the company's security detection, threat intelligence, and incident response functions to proactively identify, analyze, and mitigate security threats across cloud and infrastructure environments.

Key Responsibilities

Lead and mature detection engineering and incident response functions, including threat detection, response workflows, and automation
Build and maintain a comprehensive detection inventory categorized by threat type, log source, MITRE mapping, and detection method
Drive continuous validation of detections through red team, purple team, and atomic testing
Oversee ingestion of telemetry data from cloud, SaaS, endpoint, and network sources into security pipelines
Automate, standardize, and improve incident response workflows to ensure they are repeatable and outcome-focused
Lead post-incident reviews, root-cause analyses, and track corrective actions to closure
Correlate threat intelligence, detection gaps, and hunt findings into a prioritized security roadmap
Drive detection-to-remediation processes by collaborating with cross-functional teams
Produce dashboards linking technical security posture to business risk and ownership metrics
Lead scenario-based tabletop exercises, detection drills, and incident simulations

Requirements

10 years in cybersecurity, including 5 years in detection, incident response, or SecOps leadership
5 years of people management experience, including direct management of security engineering, detection engineering, or incident response teams, with responsibility for coaching, performance management, and team development
Proven experience leading detection engineering and incident response teams at enterprise scale
Deep expertise with SIEM Splunk preferred, SOAR Tines, XSOAR, and EDR CrowdStrike
Experience with cloud telemetry and detection including CloudTrail, GuardDuty, VPC flow
Knowledge of threat modeling, MITRE ATT&CK, and TTP-to-detection lifecycle
Experience with detection-as-code practices, version control, and CI/CD pipelines
Hands-on skills validating detections through replay, simulation, and log mining
Familiarity with frameworks such as CIS Controls, NIST 800-53, and SOC 2
Ability to translate complex security data into clear, executive-level insights
Proven cross-team collaboration with Infra, GRC, Product Security, and Application teams
Strong written and verbal communication skills with an emphasis on clarity and measurable outcomes
Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field, or equivalent practical experience