Senior Manager, Security Platform Engineering

Todyl is a dynamic start-up focused on simplifying complex networking and security solutions for businesses. They are seeking a Senior Manager to lead engineering teams responsible for core security systems, ensuring high-quality delivery and operational excellence while collaborating closely with security practitioners to meet their needs.

Responsibilities:

• Manage two system-aligned engineering teams covering the Detection Engine, TIP, SOAR, and Case Management
• Own hiring, performance, coaching, and career development for the engineering group, including developing team leads and senior engineers into broader leadership responsibilities
• Maintain a high technical bar through design reviews, code review standards, and architectural guidance
• Own the definition of done: establish acceptance criteria for security-facing functionality with operator sign-off from SOC, Detection Engineering, and Threat Intelligence
• Own production operations for these systems: on-call rotations, incident review, SLOs, and reliability engineering
• Own release quality and delivery predictability across both teams
• Coordinate shared infrastructure, deploy tooling, and engineering standards with our central Engineering organization
• Own the roadmap for the Detection Engine, TIP, SOAR, and Case Management, balancing operator needs, platform health, and partner-visible improvements
• Run product discipline for these systems: quarterly planning, success metrics, and written problem statements for major initiatives
• Own the quality and roadmap of partner-visible surfaces—case presentation foremost, as the primary way partners see the value of our security work—drawing partner signal from our customer-facing teams and coordinating with Product Management on go-to-market and the SIEM boundary
• Own the alert-working and threat hunting workflows these systems provide: investigation surfaces, hunt tooling and query capabilities, and the alert-to-case lifecycle
• Set and evolve the architectural direction for streaming detection infrastructure, intelligence pipelines, and automation systems
• Contribute through design documents, prototypes, and technical standards—staying out of critical-path delivery
• Guide how these platforms support practitioner-built automation: the APIs, workflow primitives, and extensibility that let security teams build detection authoring, enrichment, and validation workflows on the systems
• Ensure the Detection Engine, Case Management, and supporting systems expose the data, APIs, and integration points our AI SOC capabilities depend on, in close partnership with the AI/ML team that owns that initiative
• Work directly with Detection Engineering, Threat Intelligence, and MXDR as the customers of these systems: intake their requirements, close feedback loops, and treat operator effectiveness as the primary measure of success
• Translate operational pain into engineering priorities, and engineering trade-offs back into terms practitioners can act on
• Partner with these teams on telemetry, alert-working workflows, hunt tooling, and case presentation improvements
• Own outcomes including: System reliability and SLO attainment for the Detection Engine, TIP, and SOAR
• Delivery predictability and quality across both teams
• Team health, retention, and leadership development
• Track and improve metrics such as: Operator-reported tooling effectiveness (SOC, DE, TI acceptance and satisfaction)
• Incident frequency and time-to-recovery for owned systems
• Cycle time from accepted requirement to production

Requirements:

• Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience
• 8+ years in software or security engineering, including significant experience building security products or detection/response tooling
• 3+ years managing engineering teams, with experience managing 8+ engineers or multiple teams
• Experience developing team leads or first-line managers
• Track record of owning production systems: on-call programs, incident management, SLOs
• Experience establishing delivery quality practices: acceptance criteria, review standards, release discipline
• Proven ability to set architectural direction while staying out of the critical path
• Experience running roadmap and prioritization processes across multiple teams
• Strong background in data-intensive systems: streaming and log pipelines (Kafka, Logstash), analytical data stores (ClickHouse, MySQL), and parsing/enrichment (GROK)
• Proficiency with Go and Python service development, SQL, Git, and CI/CD tooling (Argo or similar)
• Experience with LLM/agent infrastructure: building or overseeing agentic workflows, model integration, or AI-assisted automation in production
• Working knowledge of the detection and response domain: how SOCs, detection engineering, and threat intelligence teams operate, how analysts work alerts, hunt, and manage cases, and what they need from their tooling
• Experience operating across organizational boundaries with shared infrastructure and platform teams
• Strong written communication: design documents, roadmaps, and decision records
• Ability to represent engineering trade-offs to security practitioners and security needs to engineering organizations
• Experience at a security vendor building detection, SIEM, SOAR, or intelligence products
• Experience in an enterprise detection & response organization that built its own tooling
• Experience with MSP/MSSP or multi-tenant platform delivery