Enterprise Security Engineering Senior Manager

THE POSITION Our roster has an opening with your name on it. FanDuel is seeking an experienced, high-impact security leader to serve as Senior Manager, Detection and Response (DART). In this role, you will lead and scale DART—the operational engine and front-line defensive capability within FanDuel’s modern Cyber Fusion Center (CFC). DART is accountable for the end-to-end operational execution of security operations, advanced security investigations, operational orchestration, and detection lifecycle improvements across FanDuel’s multi-cloud, identity, endpoint, and application ecosystems. You will lead a high-performing team of detection and response engineers, modernizing operations by pairing engineer judgement with SAGE (our agentic automation and triage layer) and collaborating closely with specialized partner teams including Threat Intelligence, Security Escalations & Research, and Cyber Defence Engineering. We’re looking for someone who came up through the technical ranks — who has built detection systems, run incident response, and understands how to use AI in detection and response effectively. If you’re energized by ownership, challenges, and building something that truly matters, this is your role. You will operate as a player–coach, leading a team of engineers while remaining hands-on in architecture, tooling, and incident leadership. What You’ll Do - Build, mentor, and lead a world-class security team of detection and incident response engineers. - Set the technical roadmap planning and strategy for DART. - Establish and manage team rhythms, handovers, on-call schedules, operational KPIs, and training/readiness programs. - Foster a culture of technical rigor, continuous learning, blameless reviews, and operational defensibility. - Inspire, motivate, support and guide the team. - Drive proactive detection improvement: systematically convert near-misses, incident findings, and false-positive burdens into prioritized tuning requests, correlation rules, and telemetry uplift backlogs. - Own the CI/CD pipeline and improve the existing detection architecture by implementing AI workflows and neural detection deep learning layer backed by symbolic logic. - Own day-to-day triage, queue health, case progression discipline, and operational response across SIEM, EDR, cloud, identity, and application telemetry. - Serve as an operational escalation point and response commander during critical security events, coordinating and commandeering high sev incidents. - Ensure clear operational handoffs to technology and engineering teams who own permanent remediation and service restoration. - Partner with platform teams to maximize the impact of SAGE, streamlining automated enrichment, detection coverage, and initial triage so engineers focus on complex detection pipelines and advanced investigations. - Direct peacetime operational capacity toward playbook modernization, tabletop exercises, and runbook automation. - Operationalize seamless escalation pathways:Partner with VTI for threat actor profiling, exploitability validation, and threat-informed prioritization.Escalate novel, high-severity, or complex tradecraft investigations to SER while maintaining operational continuity. - Partner with Legal, Privacy, Compliance, Risk, and Technology leadership to ensure incident timelines and decision logs meet regulatory and audit standards. - Define and hold the team accountable to operational SLOs/SLAs, including MTTD (Mean Time to Detect), MTTC (Mean Time to Contain), triage velocity, and case QA scores. - Maintain auditable case management standards, ensuring evidence preservation, decision tracking, and defensible timelines for every handled event. What We’re Looking For - Experience: 8+ years in Detection and Response, with 3+ years of direct people management experience leading incident responders and detection engineers. - Technical Depth: Deep working knowledge of modern security operations, detection engineering and CI/CD pipelines, incident response lifecycles, and forensic analysis across enterprise environments. - Incident Command: Proven ability to remain calm, direct actions, and communicate clearly to both executive stakeholders and engineering teams during high-stakes incidents. - Modern SecOps Mindset: Experience in transitioning teams beyond legacy "ticket-clearing" SOC models into intelligence-led, automated, and agentic response environments. - Framework Mastery: Strong understanding of MITRE ATT&CK, NIST SP 800-61, PR3TACK and cloud security architecture. - Operational Discipline: Track record of defining, tracking, and improving operational metrics (MTTD, MTTR/MTTC, alert fidelity, false-positive reduction). Nice to Have - Relevant industry certifications (e.g., CISSP, CISM, GIAC GCIH / GCFA / GNFA / GCDA). - Experience operating in high-volume, highly regulated, 24/7 environments (gaming, sports tech, fintech, bigtech or large-scale e-commerce). - Experience with agentic AI/LLM-assisted security workflows and SOAR orchestration development. - Familiar with Neuro-Symbolic AI in Detection and Response.