Head of Enterprise Security Engineering

About The Team

Enterprise Security builds and operates the security capabilities that protect USDS JV's enterprise environments and enable Cyber Defense teams to prevent, detect, investigate, and respond to threats. We bring together software engineering, security engineering, and production operations to turn security requirements into reliable, scalable services. Our work spans security telemetry and analytics, host and network defense, threat-intelligence integration, response automation, and the platforms supporting investigations.

We partner with security operations, threat detection and response, infrastructure, identity, gateway, and data teams to strengthen defenses across the enterprise. Our focus is not simply deploying security tools: it is engineering an integrated defense capability with dependable coverage, actionable data, and sustainable operations.

Key Responsibilities

• Own the End-to-End Lifecycle: Direct the design, development, integration, deployment, and operation of the Cyber Defense platform portfolio. Scope includes security information and event management (SIEM), security orchestration, automation and response (SOAR), case management, threat-intelligence integrations, host and network security tooling, and supporting capabilities.
• Define an Integrated Security Platforms: Establish how telemetry, analytics, security controls, and response workflows work together. Set technical standards, resolve architectural gaps, and make build-versus-buy decisions that balance defensive effectiveness, reliability, cost, and long-term maintainability.
• Engineer Reliable Security Data and Automation: Build and improve telemetry ingestion, normalization, enrichment, and service integrations. Partner with detection engineers, threat hunters, and incident responders to translate operational needs into tested platform features and safe, auditable automation.
• Own Production Reliability and Operations: Establish service-level objectives, monitoring, capacity planning, on-call coverage, runbooks, recovery procedures, and disciplined change management. Lead restoration of owned services during production incidents and drive post-incident improvements that eliminate recurring failures and reduce operational toil.
• Continuously Improve Defensive Effectiveness: Use threat intelligence, adversary techniques, control testing, and incident findings to prioritize engineering improvements. Close persistent coverage and control gaps with durable solutions rather than repeated manual remediation.
• Orchestrate Cross-Functional Delivery: Coordinate dependencies and shared control boundaries with Cyber Defense, infrastructure, identity, gateway, privacy, and compliance partners. Establish clear service ownership and support expectations, and provide evidence of control effectiveness for the systems your team owns.
• Build a High-Performing Team. Set the Technical Vision and Roadmap

Minimum Qualifications

• Bachelor’s degree in Computer Science, Engineering, Information Security, or a related field, or equivalent practical experience.
• Demonstrated experience leading software or security engineering teams, including hiring, performance management, developing technical leaders, and delivering complex initiatives across multiple teams.
• A track record of defining security architecture and department-level technical plans, or plans of comparable scope, and owning the delivery and ongoing production operation of enterprise-scale security platforms.
• Strong technical depth in security data platforms or defensive tooling, with experience integrating capabilities such as SIEM, SOAR, host or network defense, threat intelligence, or investigation workflows.
• Strong software engineering judgment across distributed systems, APIs, data pipelines, secure development practices, and automated testing, with the ability to guide architecture and implementation decisions.
• Experience establishing reliable service operations, including observability, incident management, on-call practices, recovery planning, and measurable service objectives.
• Ability to translate security risks and business requirements into prioritized engineering plans, influence partners across organizational boundaries, and communicate technical trade-offs clearly.

Preferred Experience

• Experience leading a portfolio of interconnected security services and developing technical leads or front-line engineering managers.
• Experience with high-volume security telemetry, event correlation, detection-platform enablement, automated response workflows, and investigation or case-management systems.
• Experience engineering or operating host intrusion detection, network traffic analysis, web application firewall, or data-loss-prevention capabilities.
• Experience operating security services in large-scale cloud or hybrid environments, including Oracle Cloud Infrastructure or AWS.
• Experience using adversary-informed testing, threat modeling, and incident findings to improve security architecture and validate defensive coverage.
• Experience consolidating fragmented tools, reducing operational toil, managing technology dependencies, and improving the cost and maintainability of security services.
• Experience supporting privacy-sensitive environments and maintaining auditable controls and operational evidence.