jobapplier

Proactive Cyber Defence and Engineering

Booking.com

Skills

Required

  • engineering / telemetry / SIEM / SOAR / response
  • detection
  • threat hunting / research / adversary emulation
  • automation
  • cybersecurity / security engineering / threat research / detection & response
  • moving initiatives
  • TTPs
  • MITRE
  • ATT&CK
  • modern detection engineering practice

Preferred

  • Drive automation and AI
  • detection and response capabilities

Join our Enterprise Security Cyber Defence organization as the Manager of Proactive Cyber Defence & Engineering. In this leadership role, you will lead a team of specialists in threat-informed defense, focusing on understanding adversary operations and engineering scalable solutions for cyber defense. You will shape strategy, expand coverage, establish detection and response engineering at scale, run validation as a program, own metrics, leverage AI, lead exceptional people, and build visibility and partnerships across the business.

Responsibilities

  • This role includes shared participation in the team's on-call rotation.
  • Lead and manage a team of specialists in proactive cyber defense, focusing on threat-informed defense strategies and engineering scalable solutions.
  • Shape the strategy for the team, translating the broader Cyber Defense strategy into a clear, risk-based plan, and owning resource assignment and capacity planning.
  • Drive automation and AI to enhance detection and response capabilities, ensuring the team stays ahead of adversaries and continuously improves its effectiveness.

Requirements

  • 2+ years directly managing and developing engineers, researchers, or other senior technical specialists
  • 5+ years in cybersecurity, security engineering, threat research, or detection & response
  • A people-first leadership style that pairs empathy with accountability
  • A track record of moving initiatives from prototype to owned, measurable, maintained production capability
  • Real breadth across both worlds: threat hunting / research / adversary emulation and detection engineering / telemetry / SIEM / SOAR / response automation this is not a hands-on-keyboard role, but you carry enough technical depth to challenge methodology and evidence, review engineering proposals with judgement, and win the respect of a team of experts
  • Strong stakeholder communication — translating complex work into business impact and risk reduction
  • Fluency in adversary TTPs, MITRE ATT&CK, and modern detection engineering practice (detection-as-code, lifecycle management, coverage measurement)

Preferred

  • No specific degree or certification required — proven technical and leadership impact is what matters