Director, DT Threat Detection & Engineering- 90284261 - null

Your success is a train ride away!

As we move America’s workforce toward the future, Amtrak connects businesses and communities across the country. We employ more than 20,000 diverse, energetic professionals in a variety of career fields throughout the United States. The safety of our passengers, our employees, the public and our operating environment is our priority, and the success of our railroad is due to our employees.

Are you ready to join our team?

Our values of ‘Do the Right Thing, Excel Together and Put Customers First’ are at the heart of what matters most to us, and our Core Capabilities, ‘Building Trust, Accountability, Effective Communication, Customer Focus, and Proactive Safety & Security’ are what every employee needs to know and do to be most impactful at Amtrak. By living the Amtrak values, focusing on our capabilities, and actively embracing and fostering diverse ideas, backgrounds, and perspectives, together we will honor our past and make Amtrak a company of the future.

Job Summary

Play a critical role in leading and advancing the organization's threat detection and cyber defense engineering capabilities. Responsible for overseeing the development, implementation, and continuous improvement of cyber threat detections, security automation, and defensive engineering solutions that support the Security Operations Center (SOC), Cyber Threat Intelligence (CTI), Threat Hunting, and Penetration Testing teams.

Lead a team of detection engineers and cybersecurity developers responsible for building and maintaining scalable detection content across multiple security platforms, developing SOAR automations, integrating threat intelligence into security controls, and creating innovative cyber defense capabilities. Drive the organization's ability to rapidly detect, investigate, and respond to evolving cyber threats while advancing operational efficiency through automation and engineering excellence.

Essential Functions

Strategic Leadership & Program Management

• Develop and execute the strategic vision for Threat Detection & Engineering aligned with cybersecurity objectives and emerging threats.
• Establish and maintain a threat detection strategy leveraging threat intelligence, threat hunting, penetration testing, and incident response findings.
• Lead, mentor, and develop teams of detection engineers, automation engineers, and cyber defense developers while fostering innovation and operational excellence.
• Define roadmaps, performance metrics, and maturity goals to improve detection coverage, automation, and engineering capabilities.
• Manage staffing, budgeting, workforce planning, and performance management.

Threat Detection Engineering

• Oversee the design, implementation, and lifecycle management of threat detections across SIEM, EDR/XDR, cloud, network, and identity security platforms.
• Ensure detections are aligned to MITRE ATT&CK and relevant threat actor TTPs.
• Drive continuous tuning to improve detection fidelity, reduce false positives, and enhance analyst effectiveness.
• Partner with CTI, Threat Hunting, Incident Response, and Penetration Testing teams to transform intelligence and findings into actionable detections.

Security Automation & Engineering

• Lead development of SOAR workflows, automated response capabilities, and orchestration solutions to improve operational efficiency and reduce MTTD/MTTR.
• Oversee development of security tools, integrations, APIs, and engineering solutions that enhance detection, investigation, response, and reporting.
• Ensure solutions are scalable, maintainable, and aligned with enterprise architecture and cybersecurity standards.

Operational Collaboration

• Partner with SOC leadership to ensure detection and automation capabilities support monitoring and incident response needs.
• Collaborate with Cyber Threat Intelligence, Threat Hunting, and Red Team/Penetration Testing functions to operationalize intelligence, validate detection effectiveness, identify gaps, and strengthen defenses.

Risk Management & Governance

• Assess detection coverage, identify control gaps, and prioritize engineering efforts to mitigate cyber risk to critical systems and data.
• Ensure compliance with regulatory requirements, industry standards, cybersecurity frameworks, and organizational policies.
• Develop metrics, reporting, and executive communications that provide visibility into detection effectiveness, automation maturity, operational performance, and risk reduction.

Minimum Qualifications

• • Bachelor's Degree or equivalent combination of education, training, and/or relevant experience.
  • Plus 11 years of relevant cybersecurity experience, including security operations, detection engineering, threat intelligence, threat hunting, incident response, security automation, or cyber defense engineering.
  • Experience leading technical cybersecurity teams and managing complex security engineering initiatives
  • Proficiency with software development methodologies, DevSecOps, and CI/CD pipelines
  • Experience with GitHub, source control management, and automated deployment frameworks.[GC1.1]
  • Knowledge of cloud platforms, APIs, automation frameworks, and enterprise integrations.

Preferred Qualifications

•  Bachelor's Degree or equivalent combination of education, training, and/or relevant experience.
• Plus 13 years of relevant cybersecurity experience.
•  Experience leading enterprise-scale Threat Detection Engineering, Security Operations, Security Automation, or Cyber Defense programs.
• Relevant industry certifications such as CISSP, GIAC (GCDA, GCTI, GMON, GCFA, or similar), CCSP, or related cybersecurity certifications.
• Experience implementing MITRE ATT&CK-based detection programs and SOAR/SIEM platforms in complex enterprise environments.
•  Experience supporting enterprise-scale cyber data lake or security data pipeline architectures.
• Knowledge of cloud-native security platforms and large-scale security analytics environments.

Knowledge, Skills, and Abilities

• Proven ability to lead and mentor high-performing teams of detection engineers, security automation engineers, and cybersecurity developers.
• Foster a culture of innovation, accountability, collaboration, and continuous improvement.
• Provide technical leadership and career development opportunities for engineering teams.
• Deep understanding of cybersecurity operations, threat detection methodologies, threat intelligence, incident response, threat hunting, and adversary tactics, techniques, and procedures (TTPs).
• Strong technical expertise across SIEM, SOAR, EDR/XDR, cloud security, network security monitoring, log analytics, security orchestration, and automation platforms.
• Demonstrated ability to design, build, and optimize threat detections across diverse technology environments and security tools.
•  Experience operationalizing intelligence-driven and behavior-based detection strategies aligned to frameworks such as MITRE ATT&CK.
• Knowledge of software development practices, scripting languages, APIs, automation frameworks, and cybersecurity engineering methodologies.
• Ability to establish measurable performance indicators and drive continuous improvement in detection quality, coverage, and operational efficiency.
• Strong analytical and problem-solving skills with the ability to assess complex threats and develop effective defensive engineering solutions.
• Understanding of regulatory requirements, cybersecurity frameworks, and industry standards, including NIST Cybersecurity Framework, NIST 800-53, ISO 27001, and related guidance.
• Exceptional communication and stakeholder management skills with the ability to translate complex technical concepts into meaningful business outcomes for executive and non-technical audiences.
• Strategic mindset with the ability to anticipate emerging threats, evolving attack techniques, and future cybersecurity trends while developing proactive defense capabilities.

The salary/hourly range is $179,300.00 – $232,416.00. Pay is based on several factors including but not limited to education, work experience, certifications, etc. Depending on an employee’s assigned worksite or location, Amtrak may consider a geo-pay differential to be applied to the employee’s base salary. Amtrak may offer additional incentive and pay programs to recognize and reward our employees, including a short-term incentive bonus based upon factors such as individual and company performance that is commensurate with the level of the position. 

Learn more about our benefits offerings here.

Requisition ID:167051

Work Arrangement:02-Remote Optional Click here for more information about work arrangements at Amtrak.
Relocation Offered:No
Travel Requirements:Up to 25%

You power our progress through your performance.

We want your work at Amtrak to be more than a job. We want your career at Amtrak to be a fulfilling experience where you find challenging work, rewarding opportunities, respect among colleagues, and attractive compensation. Amtrak maintains a culture that values high performance and recognizes individual employee contributions.

Amtrak is committed to a safe workplace free of drugs and alcohol. All Amtrak positions requires a pre-employment background check that includes prior employment verification, a criminal history check and a pre-employment drug screen.

Candidates who test positive for marijuana will be disqualified, regardless of any state or local statute, ordinance, regulation, or other law that legalizes or decriminalizes the use or possession of marijuana, whether for medical, recreational, or other use. Amtrak's pre-employment drug testing program is administered in accordance with DOT regulations and applicable law.

In accordance with DOT regulations (49 CFR § 40.25), Amtrak is required to obtain prior drug and alcohol testing records for applicants/employees intending to perform safety-sensitive duties for covered Department of Transportation positions. If an applicant/employee refuses to provide written consent for Amtrak to obtain these records, the individual will not be permitted to perform safety-sensitive functions.

In accordance with federal law governing security checks of covered individuals for providers of public transportation (Title 6 U.S.C. §1143), Amtrak is required to screen applicants for any permanent or interim disqualifying criminal offenses.

Note that any education requirement listed above may be deemed satisfied if you have an equivalent combination of education, training and experience.

Amtrak is an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race/color, to include traits historically associated with race, including but not limited to, hair texture and hairstyles such as braids, locks and twists, religion, sex (including pregnancy, childbirth and related conditions, such as lactation), national origin/ethnicity, disability (intellectual, mental and physical), veteran status, marital status, ancestry, sexual orientation, gender identity and gender expression, genetic information, citizenship or any other personal characteristics protected by law.