Manager, Security Detection and Response

About Us

Every moment of every day, people around the world rely on the energy they access through infrastructure built by Quanta. Comprising the largest skilled-labor force in North America, our employees are highly skilled and innovative, continually working to connect people and power. We’re building the infrastructure that supports the energy transition, and there are more opportunities than ever to be part of our team. Join us and build your career building a brighter future.

Imagine what you could do here. We encourage, inspire, and support our people to seize opportunities in our corporate office and with hundreds of our operating companies worldwide that provide solutions for the utility, renewable energy, electric power, industrial, and communications industries.

Quanta actively promotes and maintains a culture of belonging where all employees can be themselves, live their values, and find opportunities to succeed. When you join our team, you join a dynamic organization in which career development is encouraged, excellence is rewarded, and diversity is prized. Come find out how our people power modern life.

About this Role

The Manager, Security Detection & Response leads Quanta’s 24x7 detection and response capability, owning the full lifecycle from threat detection through containment, eradication, and post-incident review. This is a hands-on technical leadership role responsible for managing a high-performing team of SOC analysts and threat hunters, driving the maturity of Quanta’s Security Operations function, and serving as the authoritative subject-matter expert on security monitoring, SIEM, SOAR, threat hunting, and incident response across a large, complex multi-subsidiary enterprise.

The ideal candidate brings deep technical depth in threat hunting, detection operations, and incident response, proven leadership experience, and the communication skills to engage with executive stakeholders and operating unit leaders across Quanta’s broad portfolio of companies.

What You'll Do

Threat Hunting & SIEM Operations

• Own and continuously mature the enterprise SIEM platform (e.g., Splunk, Microsoft Sentinel, IBM QRadar), including content development, correlation rules, dashboards, and alert fidelity optimization across IT and OT/ICS environments.
• Lead and direct a team of threat hunters executing proactive, hypothesis-driven hunting operations using MITRE ATT&CK and other threat intelligence frameworks, with particular focus on adversary techniques targeting critical infrastructure and utilities.
• Manage SOAR playbooks and automated response workflows (e.g., Splunk SOAR, Microsoft Sentinel Automation, Palo Alto XSOAR) to accelerate mean time to detect (MTTD) and mean time to respond (MTTR); drive measurable improvement quarter over quarter.
• Oversee integration of detection telemetry from endpoint protection platforms (e.g., CrowdStrike, SentinelOne, Microsoft Defender), network security controls (e.g., secure web gateways, NGFW, proxy), vulnerability management feeds, and cloud security tooling into the SIEM pipeline.

Incident Response & Threat Management

• Direct and command security incident response operations, from initial triage and containment through root cause analysis and lessons-learned review; serve as IR commander for high-severity events.
• Develop, maintain, and rehearse incident response plans and playbooks, including scenarios specific to OT/ICS environments and critical infrastructure disruption.
• Coordinate with operating unit security liaisons, legal, communications, and executive leadership during significant security events; manage evidence preservation and chain-of-custody requirements.
• Oversee structured threat hunting campaigns; ensure hunt findings are translated into durable detections, documented in hunt reports, and fed back into the detection pipeline to continuously improve coverage.

Team Leadership & Program Management

• Lead, mentor, and develop a team of SOC analysts and threat hunters; manage hiring, performance reviews, career development, and retention.
• Define and track SOC performance metrics and SLAs; report on program effectiveness, KPIs, and risk posture to senior leadership on a regular cadence.
• Partner with Security Engineering, Identity, and GRC teams to operationalize security controls, drive vulnerability remediation prioritization, and support audit and compliance activities (SOC 2, CIS Controls v8, NIST CSF).
• Manage relationships with MDR/MSSP partners, threat intelligence providers, and relevant ISACs to augment internal capabilities and maintain situational awareness.
• Develop and deliver tabletop exercises, hunt team training, and functional security awareness content for