The Cybersecurity Threat Detection & Automation Manager will lead a team responsible for designing, developing, automating, tuning, and continuously improving advanced threat detection and response capabilities across enterprise, cloud, identity, endpoint, email, network, SaaS, and manufacturing/OT environments.
This is a hands-on player/coach leadership role . The successful candidate will not only manage, mentor, and set direction for a team of detection engineering and automation professionals, but will also remain deeply involved in technical delivery. This includes reviewing detection logic, shaping automation workflows, validating use cases, improving alert fidelity, and ensuring the program produces measurable security outcomes.
The role is critical to reducing attacker dwell time, improving investigation quality, scaling response through automation, and strengthening the organization’s overall SecOps maturity through SIEM, SOAR, detection lifecycle governance, and engineering discipline.
The ideal candidate combines deep detection engineering expertise, automation experience, incident response knowledge, strong leadership ability, and the program management discipline needed to build scalable cybersecurity capabilities in a complex enterprise environment.
The Impact You Will Make
In this role, you will help modernize and mature the organization’s threat detection and response capabilities. You will lead the team responsible for turning adversary behavior, threat intelligence, incident lessons learned, red team findings, and business risk into actionable detections, automation workflows, analyst guidance, and measurable security outcomes.
You will directly influence:
Detection coverage across enterprise, cloud, identity, endpoint, email, network, OT, and SaaS environments
Alert fidelity and false-positive reduction
Investigation speed and analyst consistency
SOAR automation maturity and response scalability
Detection lifecycle governance, testing, validation, and documentation
SecOps modernization across SIEM, SOAR, EDR, threat intelligence, and telemetry platforms
Reduced manual triage and improved operational repeatability
Stronger partnerships across SOC, Incident Response, Threat Intelligence, IT, Cloud, Identity, Network, OT, and business teams
Key Responsibilities
Leadership and Team Management
Manage, mentor, and develop a team of detection engineering and automation professionals.
Build a culture of engineering rigor, operational discipline, innovation, accountability, quality, and continuous improvement.
Operate as a hands-on manager by personally owning, reviewing, and contributing to key detections, automation workflows, technical initiatives, and program improvements.
Define and execute the threat detection and automation strategy aligned to business risk, operational needs, threat landscape, compliance requirements, and organizational priorities.
Establish the team’s operating rhythm, including intake, prioritization, backlog management, planning, peer review, release readiness, metrics, and continuous improvement.
Coach team members on detection logic, investigation quality, automation design, threat modeling, analyst usability, operational impact, and stakeholder communication.
Partner closely with SOC Monitoring, Incident Response, Threat Intelligence, SIEM Engineering, Cloud, Identity, Network, OT, IT Infrastructure, Vulnerability Management, GRC, and business stakeholders.
Threat Detection Engineering
Design, develop, tune, and optimize threat detection logic across SIEM, EDR, identity, cloud, email, network, OT, SaaS, and other security platforms.
Personally own a portfolio of high-impact detections focused on complex use cases, crown jewel risks, advanced adversary behaviors, and top enterprise threats.
Translate adversary tactics, techniques, and procedures into actionable analytics using MITRE ATT&CK, kill-chain models, threat intelligence, incident findings, red team results, vulnerability exposure, and business risk.
Conduct detection gap analysis and threat modeling to prioritize improvements based on exposure, telemetry readiness, attacker behavior, business impact, and operational value.
Build and maintain detection validation practices, including test cases, replay or verification methods, regression checks, tuning evidence, performance monitoring, and analyst feedback loops.
Ensure detections are operationally useful by including clear context, enrichment, severity guidance, response steps, escalation paths, and containment recommendations.
Measure and expand detection coverage across ATT&CK tactics and techniques, critical assets, identities, cloud platforms, OT environments, and enterprise telemetry sources.
Stay current with emerging threats, adversary tradecraft, tools, vulnerabilities, and detection methods.
SIEM, SOAR, and Security Automation
Lead the design, development, and continuous improvement of SIEM and SOAR-driven detection and response workflows.
Build and optimize SIEM content, including correlation rules, notable events, dashboards, risk-based alerts, data models, investigation views, and alert enrichment.
Develop and mature SOAR playbooks that automate enrichment, triage, evidence collection, case creation, containment recommendations, response actions, and analyst decision support.
Identify repetitive, high-volume, or high-value SOC activities that can be safely and effectively automated.
Define automation standards covering human-in-the-loop approvals, reversible actions, audit trails, exception handling, failure modes, escalation criteria, and rollback considerations.
Partner with SOC and Incident Response teams to ensure automation improves investigation speed, consistency, quality, and response outcomes without creating unnecessary operational risk.
Measure automation effectiveness using metrics such as analyst time saved, touch reduction, playbook success rate, case consistency, response acceleration, and manual effort reduction.
Drive integrations across SIEM, SOAR, EDR, email security, identity platforms, threat intelligence, ITSM, cloud security, network security, PAM, DLP/CASB, and OT monitoring platforms.
Detection Lifecycle, Governance, and Program Management
Build and mature the detection and automation lifecycle from intake through retirement.
Own standards for request intake, prioritization, design, build, peer review, testing, deployment, tuning, production monitoring, and continuous improvement.
Create and maintain use case standards, templates, documentation requirements, acceptance criteria, release gates, change history, and ownership models.
Manage the detection and automation roadmap based on threat intelligence, incident trends, MITRE coverage gaps, telemetry gaps, crown jewel risks, regulatory requirements, and business priorities.
Develop and maintain program metrics that demonstrate detection coverage, alert fidelity, false-positive trends, automation value, telemetry readiness, backlog health, delivery throughput, and investigation quality.
Partner with stakeholders to identify and resolve telemetry gaps, data quality issues, logging deficiencies, enrichment needs, and unclear ownership across the detection and response ecosystem.
Ensure detection and automation practices support internal policies, audit expectations, and applicable regulatory requirements.
Maintain audit-ready documentation and evidence, including rationale, test results, tuning notes, change history, ownership, approvals, validation results, and monitoring insights.
Communicate detection strategy, risk coverage, maturity, roadmap, and outcomes clearly to both technical and non-technical stakeholders, including executive leadership.
Preferred Qualifications
Master’s degree in Cybersecurity, Information Security, Computer Science, Engineering, or a related discipline.
10+ years of cybersecurity experience working in SOC and in creating SEIM correlations/detections and automating incident information enrichment tasks
Experience in building mature detection lifecycle practices, including intake, prioritization, testing, tuning, monitoring, regression checks, peer review, and controlled releases.
Experience building SOAR playbooks and automation workflows for phishing, malware, suspicious sign-ins, account compromise, endpoint containment, cloud alerts, privileged access activity, and threat intelligence enrichment.
Experience with detection-as-code, Git-based content management, CI/CD pipelines, automated testing, reusable detection templates, and scalable engineering patterns.
Experience operationalizing threat intelligence into detection priorities, hunting queries, enrichment workflows, and response playbooks.
Experience designing detections for identity-based attacks such as token theft, MFA bypass, device code phishing, OAuth abuse, suspicious consent grants, impossible travel, privileged role changes, and anomalous sign-ins.
Experience designing detections across endpoint, email, network, cloud, SaaS, OT/ICS, DLP, and privileged access use cases.
Experience working in large, complex enterprise or manufacturing environments with distributed stakeholders, shared ownership models, and operational constraints.
Experience partnering with SOC, Incident Response, Threat Intelligence, Vulnerability Management, Cloud, Identity, Network, OT, Legal, Privacy, GRC, and IT teams.
Ability to distinguish between detection gaps, telemetry gaps, control gaps, ownership gaps, and response process gaps.
Excellent analytical and problem-solving skills, with the ability to balance precision, scale, operational usability, and business risk.
Demonstrated ability to lead, coach, and advise team members across cultural, geographic, technical, and generational boundaries.
Passion for automation, continuous improvement, high-quality engineering practices, and building durable security systems that scale.
Technical Competency Profile
Writing and tuning SIEM detections
Splunk SPL, risk-based alerting, notable events, dashboards, and correlation searches
SOAR playbook design and automation guardrails
Detection validation, regression testing, tuning, and release readiness
MITRE ATT&CK mapping and coverage measurement
Threat-informed detection engineering
Identity attack detection, including Entra ID, MFA abuse, token theft, OAuth abuse, suspicious consent grants, and privileged role changes
Endpoint detection and response workflows
Phishing, malware, suspicious email, and account compromise use cases
Cloud security detections and CNAPP telemetry
Network, DNS, proxy, firewall, VPN, and GlobalProtect telemetry
OT/ICS monitoring considerations in manufacturing environments
Privileged access monitoring and CyberArk-style PAM telemetry
Threat intelligence enrichment and operationalization
Case management, ITSM integration, and analyst workflow improvement
Detection-as-code, Git, CI/CD, reusable templates, and content lifecycle management
The Cybersecurity Threat Detection & Automation Manager will lead a team responsible for designing, developing, automating, tuning, and continuously improving advanced threat detection and response capabilities across enterprise, cloud, identity, endpoint, email, network, SaaS, and manufacturing/OT environments.
This is a hands-on player/coach leadership role . The successful candidate will not only manage, mentor, and set direction for a team of detection engineering and automation professionals, but will also remain deeply involved in technical delivery. This includes reviewing detection logic, shaping automation workflows, validating use cases, improving alert fidelity, and ensuring the program produces measurable security outcomes.
The role is critical to reducing attacker dwell time, improving investigation quality, scaling response through automation, and strengthening the organization’s overall SecOps maturity through SIEM, SOAR, detection lifecycle governance, and engineering discipline.
The ideal candidate combines deep detection engineering expertise, automation experience, incident response knowledge, strong leadership ability, and the program management discipline needed to build scalable cybersecurity capabilities in a complex enterprise environment.
Job Systems/Information Technology
Organization Cummins Inc.
Role Category Off-site Remote
Job Type Exempt - Experienced
ReqID 2434879
Relocation Package No
100% On-Site No
Cummins and E-Verify
At Cummins, we are an equal opportunity and affirmative action employer dedicated to diversity in the workplace. Our policy is to provide equal employment opportunities to all qualified persons without regard to race, gender, color, disability, national origin, age, religion, union affiliation, sexual orientation, veteran status, citizenship, gender identity and/or expression, or other status protected by law. Cummins validates the right to work using E-Verify and will provide the Social Security Administration (SSA) and, if necessary, the Department of Homeland Security (DHS), with information from each new employee’s Form I-9 to confirm work authorization. Visit http://EEOC.gov to know your rights on workplace discrimination.
As Cummins continues to grow, you'll be provided with continuous learning opportunities, supportive benefits and a culture that values your wellbeing, safety and work-life balance. Here, you'll have the power to determine your future with innovative technology, a focus on sustainability and with a company positioned for long-term growth.
Benefits overview
Benefits and perks listed below may vary depending on the nature of your employment with Cummins and the country where you work.
Financial wellness
As a Cummins employee your retirement savings plan / pension plan / superannuation will power your path to retirement and improve your financial future.
Health & wellness
Your wellbeing is important to us. You and your family will be cared for through comprehensive health care benefits.
Diversity & inclusion
We celebrate diverse perspectives and you will be part of building a more diverse workforce to enhance our competitive position and enrich our culture.
Work-life flexibility
Your energy and commitment will be recognized through paid vacation and holidays, parental leave, adoption assistance, flexible work environments and more.
Continuing education
Whether starting or completing a degree, you will be supported by tuition reimbursement opportunities or full funding.
Paid incentive
You will receive annual merit and profit sharing based on individual and company performance.
Every employee, every community
You are empowered to volunteer at least four hours per year on company time, to give back to the communities where you work and live.
Development and growth
You will learn and grow through training and hands-on experience in an environment that values curiosity and developing talent for the future.
Requires 10+ years of cybersecurity experience, including SOC detection and automation. Leads detection engineering, SIEM/SOAR programs, lifecycle governance, threat modeling, and security teams.
Key Responsibilities
- managing teams
- engineering detections
- automating responses
Skills & Tools
SIEM, SOAR, EDR, MITRE ATT&CK, Splunk SPL, Git, CI/CD, Entra ID, CNAPP, DNS, VPN, GlobalProtect, CyberArk, PAM, DLP, CASB, ITSM
Job Details
- Category: Information Technology
- Seniority: Senior Level
- Commitment: Full Time
- Workplace: Remote — Troy, Michigan, United States
- Languages: English
Benefits
- Generous paid time off
- Tuition reimbursement
- Retirement plan
- Generous parental leave
About Cummins Inc.
A manufacturer of engines and power systems serving industrial and commercial markets. — Industry: Manufacturing