About this role
BambooHR is rebuilding its Security Operations function around an AI-native model, moving away from simply adding tooling to an existing SOC. The team is redesigning how security work happens so that automation and AI agents handle volume while people retain judgment. This manager will lead a team spanning detection engineering, threat intelligence, hunting, and incident response, running live operations while driving the architectural shift toward automated triage and agent supervision.
The role exists because the defense surface is changing shape rapidly as HR technology becomes more AI-driven and agentic. Attacks and machine identities are multiplying faster than any team can scale through hiring alone, meaning the person in this position will spend significant time defining written authority boundaries for automated systems. Ideal candidates possess a strong background in security operations, hands-on detection engineering credibility, and the leadership skills to guide a technical team through operational transformation.
What you will do
- Manage daily security operations end to end, covering alert handling, shift coverage, on-call rotation, and detection backlog priorities.
- Serve as incident commander for security incidents and partner with the VP of Information Security on severe escalations.
- Drive automation for Tier-1 triage and Tier-2 workflows using SOAR, runbooks, and agent-based systems.
- Oversee detection engineering as a product with version control, CI validation, and a complete content lifecycle.
- Establish a formal threat intelligence and hypothesis-driven hunting program grounded in employee and payroll data risks.
- Build detection and response coverage for AI-era threats including prompt injection and machine identity scaling.
- Lead, hire, mentor, and evaluate a technical team of security analysts, detection engineers, and threat intelligence practitioners.
What you need
- Minimum of 5 years of experience in security operations, incident response, or detection engineering.
- At least 2 years of direct experience managing a team of security analysts or detection engineers.
- Hands-on detection engineering background with experience writing, testing, and tuning detections as code in version control.
- Direct experience automating SOC workflows through SOAR, runbook automation, or LLM- and agent-based triage.
- Working fluency with modern security data platforms and lakehouse architectures for direct telemetry querying.
- Incident command experience under pressure, including executive and cross-functional communication during active incidents.
- Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent practical experience.
Skills and tech stack
Questions candidates ask
What is the location policy for this role?
This is a Utah-based hybrid position which will require some regular in-office days each week.
Are there any mandatory pre-employment checks?
Employment with BambooHR is contingent on passing both a background and credit check.
What is the primary focus of this security operations team?
BambooHR is rebuilding its Security Operations function around AI, designing workflows so that automation and AI agents carry the volume while people carry the judgment.