FREE ACCESS
5,000–10,000 jobs/day
See all jobs on JobTailor
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Manager, Threat Detection Engineer
CarlyleManager leading threat detection engineering and cyber threat intelligence for Carlyle, a global investment firm. Developing detections, intelligence, automation, and security partnerships.
Posted 8/5/2026full-timeWashington, DC • District of Columbia, Washington • 🇺🇸 United StatesMid-LevelSenior💰 $160,000 - $180,000 per yearWebsite
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in threat detection engineering, cyber threat intelligence, and the development of production-ready detection logic. Proficient in managing complex security processes, integrating systems, and utilizing AI-assisted tools to enhance detection and response capabilities.
Highest-signal resume keywords
Threat Detection EngineeringCyber Threat IntelligenceProduction Detection Logic DevelopmentAutomation DevelopmentSIEM/EDR/XDR Knowledge
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Detection Logic DevelopmentStructured Query LanguageAnalytic Language ProficiencyAutomation ScriptingData Quality DiagnosisThreat Intelligence AnalysisDetection TestingIncident Response CoordinationAdversary Behavior AnalysisMITRE ATT&CK Framework
Soft Skills
CoachingTechnical DocumentationCross-Functional CollaborationCommunication SkillsProblem-Solving
Tools & Technologies
SIEMEDR/XDRSOARAPIsAI-Assisted ToolsDigital-Risk CapabilitiesCase-Management SystemsCloud Security Telemetry
Certifications & Qualifications
Relevant Cybersecurity Certifications
Industry Keywords
CybersecurityInformation SecurityThreat DetectionDigital RiskDark-Web AnalysisDomain ImpersonationExecutive Protection
Tech Stack
Tools & technologiesCloudCyber SecuritySQL
About the role
Key responsibilities & impact- Own the detection content lifecycle from requirements and design through testing, deployment, tuning, and retirement
- Develop high-fidelity detections across endpoint, identity, email, network, cloud, and business-critical application telemetry
- Translate adversary behaviors, threat intelligence, incident learnings, and control gaps into production-ready analytics
- Coordinate targeted threat hunts with incident response and security partners
- Review technical work, establish reusable standards, and coach contributors
- Manage intelligence requirements and produce strategic, operational, and tactical intelligence assessments and briefings
- Turn intelligence into prioritized detection, hunting, hardening, and response requirements
- Govern indicator and intelligence-data lifecycles and maintain information-sharing relationships
- Coordinate monitoring for dark-web activity, lookalike domains, social-media threats, impersonation, exposed information, and other digital risks
- Support executive protection with cyber and digital-risk intelligence
- Work with Legal, Communications, service providers, and business stakeholders on assessments, escalations, and takedowns
- Use AI-assisted and analytical tools to develop, translate, test, and document detection rules
- Build and maintain automation playbooks for alert enrichment, evidence correlation, investigation summaries, prioritization, routing, and recommendations
- Develop scripts, integrations, and data transformations connecting detection, intelligence, case-management, and response workflows
- Pilot workflow changes, train affected analysts, and measure adoption, investigation time, quality, and rework
- Improve telemetry coverage, data quality, integration reliability, scalability, and cost effectiveness
- Translate the Threat Detection and Intelligence strategy into an actionable roadmap and prioritized backlog
- Build partnerships across incident response, vulnerability management, engineering, infrastructure, cloud, identity, and Communications
- Define operating handoffs, ownership boundaries, and escalation paths
- Present metrics, risks, recommendations, and progress updates to technical and non-technical audiences
- Monitor service-provider performance and resolve delivery, handoff, and escalation issues
Requirements
What you’ll need- Bachelor's degree required; cybersecurity, computer science, information systems, engineering, or related concentration strongly preferred, or equivalent relevant professional experience
- Advanced degree in a related discipline preferred
- 5–7 years of relevant information-security or cybersecurity experience
- 4+ years of hands-on experience spanning threat detection engineering and cyber threat intelligence
- Experience developing production detections and using intelligence to improve detection, hunting, or response
- Experience owning complex security processes or services and leading cross-functional technical initiatives through measurable operational adoption
- Hands-on experience creating, testing, deploying, and tuning production detection logic via structured query, rule, or analytic language
- Experience with security telemetry from multiple domains and diagnosing data-quality or schema issues affecting detection outcomes
- Experience developing automation with a general-purpose programming language
- Experience integrating systems through APIs, structured data formats, and version-controlled workflows
- Demonstrated use of AI-assisted or analytical techniques in a production security workflow, including testing generated content and measuring results
- Deep knowledge of adversary behavior, detection engineering methods, and practical MITRE ATT&CK use
- Working knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, case-management, and digital-risk capabilities
- Strong understanding of detection testing, data validation, alert fidelity, false-positive reduction, lifecycle governance, intelligence standards, indicator confidence, and aging
- Ability to write technical requirements, detection documentation, intelligence assessments, executive summaries, operating procedures, and recommendations
- Ability to review technical work, coach others, and improve team practices without formal reporting authority
- Relevant certifications are preferred
- Experience with cloud security telemetry and controls, dark-web analysis, domain impersonation, executive-protection digital risk, takedown coordination, or multiple detection languages is preferred or strongly preferred
- Examples of detection languages include Sigma, KQL, SPL, XQL, YARA-L, EQL, SQL, and YARA
Benefits
Comp & perks- Retirement benefits
- Health insurance
- Life insurance and disability benefits
- Paid time off
- Paid holidays
- Family planning benefits
- Various wellness programs
- Eligibility for an annual discretionary incentive program, dependent on individual and organizational performance