Director, Threat Hunting and Adversary Response

Director Threat Hunting and Adversary Response

Are you ready to lead elite cybersecurity teams in the fight against advanced cyber threats At Deepwatch youll have the rare opportunity to shape the future of adversary detection and response at scale working with cutting-edge technology global enterprises and a highly skilled team thats redefining modern cyber defense. If youre a strategic leader with a passion for building high-impact teams and staying ahead of evolving threats this is the role for you.

The Director of Threat Hunting and Adversary Response reports to the EVP Global Cyber Operations and is responsible for driving the vision development and execution of Deepwatchs Threat Hunting and Adversary Response services and strategy. As a part of this mission you will manage the Threat Hunting and Adversary Response Teams and oversee the development of both programs. As part of a larger team the Director of Threat Hunting and Adversary Response must work collaboratively with Deepwatch leadership Program Managers Customer Success customers partners and sales to run our industry-leading service offerings.

In this role youll get to:

People Leadership

• Ensure operational readiness through training staffing and workload management.
• Partner with HR and Talent Acquisition on recruiting staffing forecasts succession planning and workforce planning.
• Conduct regular performance reviews coaching and professional development planning.
• Set and track key performance indicators (KPIs) to ensure team objectives and service level agreements (SLAs) are met or exceeded.
• Foster a culture of collaboration innovation and continuous improvement.
• Attract retain and develop high-performing talent aligned with business needs.
• Provide strategic direction day-to-day leadership and oversight for the Threat Hunting and Adversary Response teams.

Customer Engagement

• Act as an escalation point for customer Threat Hunting engagements and investigations.
• Represent Deepwatch in customer interactions incident briefings and post-mortems to ensure customer satisfaction and transparency.
• Communicate technical information clearly to executive and non-technical audiences.
• Collaborate with Sales Customer Success and Marketing to support pre-sales engagements service adoption and customer education.

Technical Leadership

• Define and execute the strategic roadmap for Threat Hunting and Adversary Response programs.
• Guide detection engineering and threat hunting methodologies based on attacker behaviors threat intel and telemetry sources.
• Maintain subject matter expertise across key cybersecurity domains and lead efforts in tool adoption and process optimization.
• Provide input on technology forecasting tooling decisions and budget planning.
• Ensure continuous innovation and alignment with emerging adversary tactics techniques and procedures (TTPs).
• Oversee the integration of automation orchestration and threat intelligence to enhance detection and response capabilities.
• Lead the evolution of services toward an intelligence-driven consultative model that anticipates and mitigates threats.

To be successful in this role youll need:

• 12 years of progressive experience in Cybersecurity Operations Threat Hunting or Incident Response.
• 7 years experience leading and developing technical teams in a high-stakes customer-facing environment.
• Experience working within a Managed Security Service Provider (MSSP) environment and/or supporting Managed Detection and Response (MDR) services with a deep understanding of multi-tenant security operations and customer engagement.
• Demonstrated success in defining and maturing security services and capabilities.
• Subject Matter Expertise (SME) in at least one of the following areas:
• Digital Forensics & Incident Response (DFIR)
• Malware Analysis
• Threat Hunting
• Threat Intelligence
  Penetration Testing
• Experience developing proactive hunting methodologies leveraging threat intelligence and identifying advanced adversary tactics (TTPs).
• Ability to leverage EDR SIEM SOAR threat intelligence platforms and forensic tool sets (e.g. Splunk Google SecOps CrowdStrike SentinelOne Defender Velociraptor EnCase) to drive advanced detection and response.
• Strong written and verbal communication skills including executive briefings and incident communications.

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.
• A lawful permanent resident of the United States.
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall but to ensure compliance with import/export regulations. If you do not meet these requirements we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.

Statutory Pay Disclosure

The anticipated salary range for this role is $154000 to $196000 bonus stock options benefits. Actual compensation may vary from posted hiring range based upon geographic location work experience education and/or skill level.