Director of Detection and Response
San Francisco · USD 280,000-385,000 · Full-time · Hybrid · Posted Oct 8, 2026
At a glance
- Employment
- Full-time
- Workplace
- Hybrid
- Location
- San Francisco
- Salary
- USD 280,000-385,000
About the role
- Harvey is looking for a Director of Detection and Response to build and lead the team that identifies threats, responds decisively to incidents, and turns what is learned into stronger defenses.
- This is a technical leadership role for someone who can build an exceptional team, earn the trust of senior engineers, and bring clarity to high-stakes situations across production and corporate environments.
Responsibilities
- Build and lead the organization, hiring and developing detection engineers, incident responders, and technical leaders while establishing clear ownership and a culture of continuous learning.
- Own incident response and crisis readiness, leading Harvey's response to major security incidents and coordinating investigation, containment, recovery, and executive communication.
- Build clear severity criteria, escalation paths, playbooks, and sustainable 24/7 coverage for critical threats while developing incident commanders and cross-functional responders through exercises.
- Set the technical direction for telemetry, detection pipelines, forensic tooling, and response automation across cloud, endpoint, identity, SaaS, and application environments.
- Apply software engineering practices to test detections, improve signal quality, and reduce manual work, evaluating AI-assisted investigation with measurable quality and appropriate human oversight.
- Use threat intelligence, hunting, and an attacker's perspective to prioritize scenarios that matter to Harvey, including account compromise, data theft, insider risk, and privileged-access abuse.
- Partner with offensive security and platform owners to validate coverage and close blind spots.
- Partner with Engineering, IT, Legal, Privacy, Communications, and Customer Trust on sensitive investigations and crisis decisions while establishing clear escalation and decision authority.
- Drive blameless reviews and ensure corrective actions have owners, deadlines, and verified outcomes.
- Measure detection coverage, time to detect and contain, recurring failure modes, and responder workload, using those results to guide investments and reduce customer impact.
Requirements
- Experience building and leading Detection and Response, incident response, or security engineering teams in a technology company with complex production systems.
- A record of hiring strong engineers, developing technical leaders, and scaling both the team and its operating model.
- Deep incident response experience and demonstrated judgment during serious security events, including leading investigations with incomplete information and making timely containment decisions.
- Strong technical foundations in cloud infrastructure, operating systems, networking, identity, and attacker tradecraft, with depth in detection engineering, threat hunting, or digital forensics.
- An engineering approach to security operations, backed by experience building detection platforms, investigation tools, or response automation.
- The ability to turn business risk into a focused strategy and deliver it through influence and partnership.
Skills
- Detection Engineering
- Incident Response
- Threat Hunting
- Digital Forensics
- Threat Intelligence
- Cloud Infrastructure
