Detection and Response Lead

One Identity (Quest)·Remote

Pay not statedSenior levelFull-timeRemote

Apply on One Identity (Quest)'s site Track your applications and see your fit: start free

Read from the company's own careers page; you apply on their site.

How well do you fit this job?

Upload your resume to see each requirement checked against your profile, in under a minute.

Check my fit

Hard to read?

About the role

Coverage spans external attacks and insider threats across everything we run, and the detection work is shaped around that full range. Twenty-four seven monitoring is handled by a managed provider, which means this is not a shift-rotation job. The provider covers first-line triage and escalates when needed.

What you'll do

Own what gets detected
Set the strategy for detection use cases and own the catalog built from it: identity and authentication abuse, privileged access misuse
Treat detections as code
Detection changes arrive as pull requests with the reasoning attached
Own the signal quality problem end to end. Tune what's noisy, retire what's dead, and know which gaps are deliberate