Enterprise Security Engineering Senior Manager

Leads and scales DART, the operational engine and front-line defensive capability within the Cyber Fusion Centre. It is accountable for end-to-end operational execution of security operations, advanced security investigations, operational orchestration, and detection lifecycle improvements across multi-cloud, identity, endpoint, and application ecosystems. The position leads a high-performing team of detection and response engineers, modernising operations by pairing engineer judgement with SAGE, an agentic automation and triage layer, and collaborating with Threat Intelligence, Security Escalations & Research, and Cyber Defence Engineering.

• Build, mentor, and lead a world-class security team of detection and incident response engineers, inspiring, motivating, supporting, and guiding the team while fostering a culture of technical rigour, continuous learning, blameless reviews, and operational defensibility.
• Set the technical roadmap planning and strategy for DART, and establish and manage team rhythms, handovers, on-call schedules, operational KPIs, and training and readiness programmes.
• Drive proactive detection improvement by systematically converting near-misses, incident findings, and false-positive burdens into prioritised tuning requests, correlation rules, and telemetry uplift backlogs.
• Own the CI/CD pipeline and improve the existing detection architecture by implementing AI workflows and a neural detection deep learning layer backed by symbolic logic.
• Own day-to-day triage, queue health, case progression discipline, and operational response across SIEM, EDR, cloud, identity, and application telemetry.
• Serve as an operational escalation point and response commander during critical security events, coordinating and commandeering high-severity incidents, and ensure clear operational handoffs to technology and engineering teams that own permanent remediation and service restoration.
• Partner with platform teams to maximise the impact of SAGE, streamlining automated enrichment, detection coverage, and initial triage so engineers focus on complex detection pipelines and advanced investigations, and direct peacetime operational capacity toward playbook modernisation
• Tabletop exercises, and runbook automation.
• Operationalise seamless escalation pathways by partnering with VTI for threat actor profiling, exploitability validation, and threat-informed prioritisation, and by escalating novel, high-severity, or complex tradecraft investigations to SER while maintaining operational continuity.
• Partner with Legal, Privacy, Compliance, Risk, and Technology leadership to ensure incident timelines and decision logs meet regulatory and audit standards.
• Define and hold the team accountable to operational SLOs/SLAs, including MTTD, MTTC, triage velocity, and case QA scores, and maintain auditable case management standards that ensure evidence preservation, decision tracking, and defensible timelines for every handled event.

• 8+ years in Detection and Response, with 3+ years of direct people management experience leading incident responders and detection engineers.
• Technical background gained through the technical ranks, with experience building detection systems, running incident response, and using AI effectively in detection and response.
• Deep working knowledge of modern security operations, detection engineering and CI/CD pipelines, incident response lifecycles, and forensic analysis across enterprise environments.
• Proven ability to remain calm, direct actions, and communicate clearly to both executive stakeholders and engineering teams during high-stakes incidents.
• Experience in transitioning teams beyond legacy 'ticket-clearing' SOC models into intelligence-led, automated, and agentic response environments.
• Strong understanding of MITRE ATT&CK, NIST SP 800-61, PR3TACK, and cloud security architecture.
• Track record of defining, tracking, and improving operational metrics such as MTTD, MTTR/MTTC, alert fidelity, and false-positive reduction.

• Relevant industry certifications such as CISSP, CISM, GIAC GCIH, GCFA, GNFA, or GCDA.
• Experience operating in high-volume, highly regulated, 24/7 environments such as gaming, sports tech, fintech, big tech, or large-scale e-commerce.
• Experience with agentic AI/LLM-assisted security workflows and SOAR orchestration development.
• Familiarity with Neuro-Symbolic AI in Detection and Response.

• Hybrid working arrangement

• Health plans to choose from, some as low as $0 per paycheck, including fertility and family planning programmes, mental health support, and fitness benefits.
• Generous paid time off (PTO and sick leave).
• Annual bonus and long-term incentive opportunities based on performance, plus eligibility for short-term or long-term incentive compensation including cash bonuses and stock programme participation.
• 401k with up to a 5% match.
• Commuter benefits and pet insurance.
• Medical, vision, and dental insurance; life insurance; and disability insurance.
• Paid personal time off and 14 paid company holidays.
• Paid sick time in accordance with applicable state and federal laws.
• Benefits differ across location, role, and level.

FanDuel Group is the premier mobile gaming company in the United States and Canada, with a portfolio of leading brands across mobile wagering including America's #1 Sportsbook, FanDuel Sportsbook; FanDuel Casino; FanDuel Racing; and its daily fantasy sports product. FanDuel Group is a subsidiary of Flutter Entertainment, the world's largest sports betting and gaming operator, with a portfolio of globally recognised brands and traded on the New York Stock Exchange (NYSE: FLUT).