Director, Threat Hunting and Adversary Response

Director, Threat Hunting and Adversary Response

Are you ready to lead elite cybersecurity teams in the fight against advanced cyber threats? At Deepwatch, you’ll have the rare opportunity to shape the future of adversary detection and response at scale — working with cutting-edge technology, global enterprises, and a highly skilled team that’s redefining modern cyber defense. If you're a strategic leader with a passion for building high-impact teams and staying ahead of evolving threats, this is the role for you.

The Director of Threat Hunting and Adversary Response reports to the EVP, Global Cyber Operations, and is responsible for driving the vision, development, and execution of Deepwatch’s Threat Hunting and Adversary Response services and strategy. As a part of this mission, you will manage the Threat Hunting and Adversary Response Teams and oversee the development of both programs. As part of a larger team, the Director of Threat Hunting and Adversary Response must work collaboratively with Deepwatch leadership, Program Managers, Customer Success, customers, partners, and sales to run our industry-leading service offerings. 

In this role you’ll get to: 

People Leadership

• Ensure operational readiness through training, staffing, and workload management.
• Partner with HR and Talent Acquisition on recruiting, staffing forecasts, succession planning, and workforce planning.
• Conduct regular performance reviews, coaching, and professional development planning.
• Set and track key performance indicators (KPIs) to ensure team objectives and service level agreements (SLAs) are met or exceeded.
• Foster a culture of collaboration, innovation, and continuous improvement.
• Attract, retain, and develop high-performing talent aligned with business needs.
• Provide strategic direction, day-to-day leadership, and oversight for the Threat Hunting and Adversary Response teams.

Customer Engagement

• Act as an escalation point for customer Threat Hunting engagements and investigations.
• Represent Deepwatch in customer interactions, incident briefings, and post-mortems to ensure customer satisfaction and transparency.
• Communicate technical information clearly to executive and non-technical audiences.
• Collaborate with Sales, Customer Success, and Marketing to support pre-sales engagements, service adoption, and customer education.

Technical Leadership

• Define and execute the strategic roadmap for Threat Hunting and Adversary Response programs.
• Guide detection engineering and threat hunting methodologies based on attacker behaviors, threat intel, and telemetry sources.
• Maintain subject matter expertise across key cybersecurity domains and lead efforts in tool adoption and process optimization.
• Provide input on technology forecasting, tooling decisions, and budget planning.
• Ensure continuous innovation and alignment with emerging adversary tactics, techniques, and procedures (TTPs).
• Oversee the integration of automation, orchestration, and threat intelligence to enhance detection and response capabilities.
• Lead the evolution of services toward an intelligence-driven, consultative model that anticipates and mitigates threats.

To be successful in this role you’ll need: 

• 12+ years of progressive experience in Cybersecurity Operations, Threat Hunting, or Incident Response.
• 7+ years experience leading and developing technical teams in a high-stakes, customer-facing environment.
• Experience working within a Managed Security Service Provider (MSSP) environment and/or supporting Managed Detection and Response (MDR) services, with a deep understanding of multi-tenant security operations and customer engagement. 
• Demonstrated success in defining and maturing security services and capabilities.
• Subject Matter Expertise (SME) in at least one of the following areas:
• Digital Forensics & Incident Response (DFIR)
• Malware Analysis
• Threat Hunting
• Threat Intelligence
  Penetration Testing
• Experience developing proactive hunting methodologies, leveraging threat intelligence, and identifying advanced adversary tactics (TTPs).
• Ability to leverage EDR, SIEM, SOAR, threat intelligence platforms, and forensic tool sets (e.g., Splunk, Google SecOps, CrowdStrike, SentinelOne, Defender, Velociraptor, EnCase) to drive advanced detection and response.
• Strong written and verbal communication skills, including executive briefings and incident communications.

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.
• A lawful permanent resident of the United States. 
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.

Statutory Pay Disclosure

The anticipated salary range for this role is $154,000 to $196,000 + bonus + stock options + benefits. Actual compensation may vary from posted hiring range based upon geographic location, work experience, education, and/or skill level.