Detection and Response Lead

Senior individual contributor, practice lead · India · Reports to the Director of Information Security

One Identity builds the software that decides who gets into everything else our customers run, and the ground this practice defends is our own: the corporate environment and the hosted services we operate in the cloud. Coverage spans external attacks and insider threats across everything we run, and the detection work is shaped around that full range.

Twenty-four seven monitoring is handled by a managed provider, which means this is not a shift-rotation job. The provider covers first-line triage and escalates when needed. This role owns everything above the provider: what gets detected in the first place, whether the coverage matches how we're actually attacked, how good the escalations are, and what happens once something real lands on the desk. Directing that relationship well is a large part of the work.

We're separating from Quest Software and building an independent security function. The team is lean and globally distributed, and this role leads the detection and response practice inside it. Scope comes from what you build and from the standard you set for what a real incident response looks like here.

• Set the strategy for detection use cases and own the catalog built from it: identity and authentication abuse, privileged access misuse, cloud control plane activity across Azure and AWS, endpoint and email vectors, and the paths specific to how our own products are deployed internally.
• Treat detections as code. Version them, review them, test them against real telemetry, and track coverage against a threat model rather than a vendor's rule count. Detection changes arrive as pull requests with the reasoning attached.
• Own the signal quality problem end to end. Tune what's noisy, retire what's dead, and know which gaps are deliberate.
• Set the telemetry standard. Decide what we need to collect and retain to investigate an incident properly, and make the case for it when that costs something.

• Lead incident response from escalation through closure: scoping, containment, evidence handling, root cause, and the write-up that survives a customer or auditor reading it.
• Direct the managed provider. Set escalation criteria, hold the quality bar on what comes through, and close the loop when something should have been caught and wasn't.
• Run the exercises that make a response work under pressure. Tabletops with engineering and leadership, and the runbooks that make an on-call decision obvious at two in the morning.
• Own the notification path. Know which obligations attach to which kinds of incident, contractual and regulatory, and make sure the clock is understood before it's running.
• Work with product security when an incident touches what we ship. Internal detection and customer-facing disclosure are different disciplines that occasionally share a root cause.

• Decide where agentic workflows belong in detection and response. Enrichment, correlation, and first-pass investigation are tractable now; containment actions are a harder call. You set where automation acts, where it recommends, and how we verify what it did.
• Automate the response path itself, not just the alerting. The measure is how much of an investigation is already done by the time a person opens it.
• Bring threat intelligence into the practice with an output attached: adversary tradecraft translated into detection use cases, hunts, or control changes.
• Advance the program's metrics: coverage against the threat model, escalation quality from the provider, time to detect and time to close, reported in terms leadership steers by.
• Hunt on a schedule. Structured hypotheses against our own telemetry, and every finding either becomes a detection or gets written down as a deliberate gap.

Eight or more years in security operations, detection engineering, or incident response, with time spent leading incidents rather than only working them. Equivalent depth counts.

• Detection engineering in a modern SIEM, with the query fluency to build and validate rules yourself. We run Microsoft Sentinel and Defender XDR.
• Identity attack fluency. Entra ID and Active Directory attack paths, token and session abuse, OAuth consent, and federation.
• Hands-on work with AI-assisted detection, triage, or investigation within the last six months, and a considered view on where automation should and shouldn't be trusted to act.

The three above are the bar. Everything below is depth we'd like and can build. If you meet the requirements and bring most of the rest, apply. We'd rather assess the gap ourselves than have you decide it for us.

This is a practice to build, not a queue to work. The managed tier handles the volume, which leaves you the engineering and the judgment: what we detect, how well, and what happens next. You'll have functional direction of the SOC analysts, with people leadership held by the director, and direct access to engineering leadership. Your incident write-ups will be read at the executive level. If you want to own a detection and response practice rather than inherit someone else's rules, this is that seat.

One Identity enables organizations of all sizes to better secure, manage, monitor, protect, and analyse information and infrastructure to help fuel innovation and drive their businesses forward.

With team members around the globe, we intend to continue to grow revenues and add value to customers.

When you join our team, you will have the opportunity to build and develop products at a scale few others can provide.

Our product portfolio serves a large base of customers and we are addressing the strategic imperatives for enterprise businesses.

Working with some of the most talented employees the industry has to offer, we provide enhanced career opportunities for team members to learn and grow in a rapidly changing environment.