Director of Detection and Response
New York · USD 280,000-385,000 · Full-time · Hybrid · Posted Oct 8, 2026
At a glance
- Employment
- Full-time
- Workplace
- Hybrid
- Location
- New York
- Salary
- USD 280,000-385,000
About the role
- Harvey is looking for a Director of Detection and Response to build and lead the team that identifies threats, responds decisively to incidents, and turns insights into stronger defenses.
- This is a technical leadership role for someone who can build an exceptional team, earn the trust of senior engineers, and bring clarity to high-stakes situations.
Responsibilities
- Build and lead the organization by hiring and developing detection engineers, incident responders, and technical leaders, and own the roadmap, staffing plan, and investment decisions.
- Own incident response and crisis readiness by leading Harvey’s response to major security incidents, coordinating investigation, containment, recovery, and executive communication.
- Build clear severity criteria, escalation paths, playbooks, and sustainable 24/7 coverage for critical threats.
- Set the technical direction for telemetry, detection pipelines, forensic tooling, and response automation across cloud, endpoint, identity, SaaS, and application environments.
- Apply software engineering practices to test detections, improve signal quality, and reduce manual work.
- Focus defenses on meaningful threats by using threat intelligence, hunting, and an attacker’s perspective to prioritize scenarios that matter to Harvey.
- Partner with Engineering, IT, Legal, Privacy, Communications, and Customer Trust on sensitive investigations and crisis decisions.
- Drive blameless reviews and ensure corrective actions have owners, deadlines, and verified outcomes.
- Measure detection coverage, time to detect and contain, recurring failure modes, and responder workload.
Requirements
- Experience building and leading Detection and Response, incident response, or security engineering teams in a technology company with complex production systems.
- Deep incident response experience and demonstrated judgment during serious security events.
- Strong technical foundations in cloud infrastructure, operating systems, networking, identity, and attacker tradecraft, with depth in detection engineering, threat hunting, or digital forensics.
- An engineering approach to security operations, backed by experience building detection platforms, investigation tools, or response automation.
- The ability to turn business risk into a focused strategy and deliver it through influence and partnership.
