Detection Engineer

Reports to: Senior Manager Threat Detection & Research

Hybrid Tampa, FL Or Remote 

While proximity to Tampa is preferred to support a hybrid schedule in our Tampa Center of Excellence, we’re open to remote candidates who can support the Eastern Time Zone.

Reporting to the Sr. Manager, Threat Detection & Research the Detection Engineer will serve as a subject matter expert in cybersecurity detections. This individual will participate in cybersecurity detection strategy, creation, tuning, validation, and correlation to ensure that Deepwatch customers have effective detections in place against an ever-changing threat landscape. Deepwatch Detection Engineers perform a wide array of tasks in an effort to increase alert fidelity, reduce false positives, and better inform MDR Security Analysts. 

Detection Engineers have a direct impact on customer security posture over time by increasing the operational efficiency and effectiveness of MDR Security Analysts and by aligning efforts with customer security priorities.

In this role, you’ll get to:

• Develop and document new Detection Capabilities for customer environments
• Work with customers to develop a comprehensive strategy for effective detections 
• Leverage industry frameworks, such as MITRE ATT&CK Framework, for customer-facing alert improvement roadmap
• Apply knowledge of common detection tools (Azure logging, command line logging, etc.) to advise customers on logging capabilities to expand applicable detection library
• Confidently prioritize log sources for ingestion and enablement
• Evaluate current monitoring and detection capabilities to identify areas for improvement
• Conduct Detection Gap Analyses 
• Manage detection capabilities to ensure appropriate coverage, effective operation, and adherence to Deepwatch standards
• Detection Enablement
• Detection Effectiveness (Tuning, Validation, etc.)
• Detection Creation
• Onboard assigned customers, establishing baseline detection coverage and detection enablement plan post onboarding
• Ensure ingested log sources conform to CIM standards

To be successful in this role, you’ll need:

• Experience working for a Managed Security Service Provider (MSSP) or similar cybersecurity organization
• Experience working and querying SIEM tools or other log-based data preferably Splunk
• Experience in engineering event detection & response tuning
• Ability to engineer creative, scalable, and out-of-the-box solutions
• Up to date with engineering best practices, security technology trends, tools, and frameworks
• Experience in developing detections for attacker tactics, techniques, and procedures (TTPs)
• Able to both investigate and create security rules in at least 1 SIEM
• Understanding of general enterprise network architecture and security incident response
• Understanding of common enterprise technologies and logging capabilities including Cloud, IDS/IPS, Firewalls, Active Directory, Anti-Virus/EDR, Proxies, and Email Gateway
• Understanding of various attack frameworks such as MITRE ATT&CK and general adversarial / defensive security techniques (e.g. the Cyber Kill Chain, and NIST)
• Ability to communicate and document technical information effectively towards various audience

Statutory Pay Disclosure

The anticipated salary range for this role is $94,500 - $118,700 + stock options + benefits. Actual compensation may vary from posted hiring range based upon geographic location, work experience, education, and/or skill level.

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.;
• A lawful permanent resident of the United States; 
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.

Manager, Site Reliability Engineering

Reports to: VP, Product Engineering 

While proximity to Tampa is preferred to support hybrid schedule in Tampa Center of Excellence, we’re open to remote candidates who can support the Eastern Time Zone.

Lead the architecture, automation, and reliability of secure, scalable cloud infrastructure (AWS, GCP) and developer platforms within a cybersecurity context. Inspire DevOps excellence, deliver high availability, and drive operational resilience—all while mentoring a high-caliber SRE team. Lead and grow a small high caliber global SRE Team, managing US based engineers. Lead the architecture, automation, and reliability of secure, scalable cloud infrastructure (AWS, GCP) and developer platforms within a cybersecurity context. Inspire DevOps excellence, deliver high availability, and drive operational resilience—all while mentoring and managing a high-caliber SRE team. 

What You’ll Do:

• Lead and grow the SRE team, setting direction, mentoring and managing engineers, and fostering excellence.
• Design and manage cloud and containerized infrastructure with IaC (Terraform).
• Implement robust CI/CD pipelines integrating security and compliance.
• Build scalable observability systems, leading the definition of SLIs / SLOs and dashboards.
• Manage incident response, root cause analysis, and postmortems; automate recovery via playbooks/runbooks.
• Drive capacity planning, performance tuning, and cost efficiency.
• Collaborate with InfoSec, DevSecOps, and Compliance teams—ensuring alignment with frameworks like FedRAMP, NIST, RMF.
• Support program-level initiatives, communicating effectively with stakeholders.
• Promote a culture of reliability, security, and developer efficiency.
• Maintain an active 'player' role, dedicating approximately 75% of your time to hands-on engineering (design, coding, and architecture) and 25% to leadership, mentorship, and management.

What You’ll Bring:

• 8+ years in SRE, DevOps, or Platform Engineering; with technical leadership experience ready to step into management as a player/coach.
• Proven cloud experience (AWS, GCP) and container orchestration (Kubernetes, Docker).
• Strong coding/scripting (Python, GO) and proficiency in IaC and GitOps.
• Deep knowledge of observability tools and defining reliability metrics.
• Experienced in incident handling (PagerDuty, Datadog) and post-incident evaluations.
• Demonstrated success in mentoring and developing junior/mid-level SRE talent, moving beyond delegation to hands-on technical coaching.
• Familiarity with regulatory or cybersecurity frameworks (FedRAMP, NIST, STIGs, RMF).
• Excellent cross-functional communication and stakeholder management.
• Preferred: certifications such as AWS, CKA, or cyber security credentials (e.g., OSCP).

Statutory Pay Disclosure:

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.;
• A lawful permanent resident of the United States; 
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.

Incident Response Analyst

Location: Hybrid,Tampa, FL / Remote 

While proximity to Tampa is preferred to support a hybrid schedule in our Tampa Center of Excellence, we’re open to remote candidates who can support the Eastern Time Zone.

Reporting  to the Manager of Adversary Response, the Incident Response Analyst operates on the front lines of active cyber conflict—defending organizations against sophisticated, real-world adversaries. This is a mission-critical role for practitioners who thrive in high-pressure environments and are driven to outpace, outthink, and disrupt advanced threat actors.
As a primary responder during live incident engagements, you will lead hands-on investigations into complex intrusions, leveraging advanced EDR and detection platforms to trace attacker behavior, contain threats in real time, and eradicate adversary presence at its source.
This role demands sharp analytical instincts, technical depth, and a relentless curiosity—paired with the discipline to execute under pressure. You won’t just respond to incidents; you’ll play a key role in defending critical environments, strengthening resilience, and raising the bar against an ever-evolving threat landscape.

In this role, you’ll get to:

• Lead end-to-end incident response engagements within customer environments, driving rapid investigation, containment, and remediation of active threats
• Conduct deep-dive forensic and malware analysis to uncover adversary tactics, techniques, and procedures (TTPs), translating findings into actionable intelligence
• Proactively hunt for advanced threats through hypothesis-driven threat hunting across diverse data sources and telemetry
• Triage and validate suspicious activity using a combination of open-source intelligence (OSINT), proprietary intelligence, and behavioral analysis
• Own the documentation of incidents, ensuring clear, defensible reporting and timeline reconstruction within case management systems
• Identify and operationalize new adversary techniques, tools, and tradecraft—scaling knowledge across the team to strengthen collective defense
• Maintain a constant pulse on the evolving threat landscape, applying emerging intelligence to real-world investigations
• Surface visibility gaps in logging, telemetry, and detection coverage, and partner with stakeholders to enhance overall security posture
• Collaborate cross-functionally to develop and refine detection content, response playbooks, and threat intelligence outputs
• Serve as a trusted advisor to customers, confidently guiding them through the full incident response lifecycle—from initial compromise to full remediation and recovery

• Proven, hands-on experience leading incident response investigations, with the ability to independently scope, analyze, and drive complex engagements to resolution
• A track record of operating in high-volume, high-complexity environments (e.g., MDR, MSSP, consulting, or enterprise IR teams), with exposure to a wide range of real-world incidents and adversary scenarios
• Deep expertise with Endpoint Detection & Response (EDR) platforms such as SentinelOne, Microsoft Defender, and CrowdStrike, including advanced querying, triage, and response actions
• Strong command of incident response methodologies and frameworks (e.g., NIST, PICERL), with the ability to apply them dynamically in fast-moving, ambiguous situations
• Experience leveraging SIEM, SOAR, case management, and threat intelligence platforms to investigate, correlate, and respond to threats at scale
• A solid understanding of attacker methodologies, including common and emerging tactics, techniques, and procedures (TTPs), with the ability to map activity to frameworks such as MITRE ATT&CK
• Exceptional communication skills, with experience presenting technical findings and strategic recommendations to both technical teams and executive stakeholders
• The ability to operate as a trusted advisor during high-pressure incidents—bringing clarity, structure, and confidence to customer engagements

Note: This role is best suited for practitioners who have been deeply immersed in live incident response environments and have built pattern recognition across numerous engagements. Candidates with limited exposure to real-world incidents may find the pace, ambiguity, and complexity of this role challenging.

Statutory Pay Disclosure 

The anticipated salary range for this role is $127,00 - $140,000 + stock options + benefits. Actual compensation may vary from posted hiring range based upon geographic location, work experience, education, and/or skill level.

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.;
• A lawful permanent resident of the United States; 
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.

Senior Product Manager

Hybrid Tampa, FL / Remote 

While proximity to Tampa is preferred to support a hybrid schedule in our Tampa Center of Excellence, we’re open to remote candidates who can support the Eastern Time Zone.

Deepwatch’s Senior Product Manager reports to the VP of Product and plays a critical role in defining and delivering our product strategy across the organization. This role partners closely with Product, Engineering, UX, Sales, Marketing, and Delivery teams to shape product requirements, drive roadmap execution, and ensure alignment from concept through delivery.
The Senior Product Manager is responsible for standardizing and evolving our product offerings, improving product positioning and documentation, and enabling scalable go-to-market execution. This role also works directly with our Customer Advisory Board to gather feedback and translate customer needs into actionable product strategy and prioritized initiatives.

In this role, you’ll get to:

• Own the evolution of the Deepwatch platform by driving requirements, prioritization, development, and delivery of product capabilities that create measurable customer value.
• Define and manage the platform roadmap, ensuring clear priorities, realistic timelines, and alignment across internal stakeholders and customer-facing teams.
• Standardize and scale product offerings across customers, including features, use cases, onboarding, reporting, dashboards, runbooks, KPIs, and customer communications.
• Serve as the voice of the customer, translating feedback, market insights, and real-world use cases into actionable product strategy and a prioritized backlog.
• Author and refine product requirements and use cases, turning complex scenarios into clear, executable specifications for engineering teams.
• Drive cross-functional alignment across Product, Engineering, UX, Sales, Marketing, and Delivery to ensure successful product execution and go-to-market readiness.
• Make informed prioritization decisions, balancing short-term execution with long-term platform strategy while maintaining stakeholder trust and transparency.
• Measure and communicate product success, defining KPIs, tracking performance, and turning insights into continuous improvement and new hypotheses.
• Enable go-to-market success by supporting internal and external training for customers, sales teams, and channel partners.
• Stay ahead of the market, developing deep expertise in industry trends, customer needs, and competitive dynamics to identify and drive new opportunities.
• Build strong internal and external relationships, collaborating effectively across teams and with partners to ensure successful outcomes and uphold Deepwatch’s reputation.
• Live and promote Deepwatch’s core values in all aspects of your work.

To be successful in this role, you’ll need to:

• Identify, define, and deliver high-impact product opportunities, translating market needs into scalable solutions
• Communicate effectively across audiences, leveraging strong presentation, organizational, and analytical skills
• Lead cross-functional teams and drive alignment, building consensus and delivering results in a matrixed environment
• Navigate complex product and process challenges, using sound judgment and independent decision-making
• Balance execution speed with long-term strategy, thriving in a fast-growing, dynamic organization
• Bring a strong understanding of modern software development practices, including building and deploying applications and data-driven systems
• Represent multiple stakeholder perspectives, acting as the voice of the customer while aligning marketing, engineering, finance, support, and operations
• Leverage data to inform decisions, with experience working at scale and translating complex datasets into actionable insights
• Be proficient with modern product and collaboration tools, such as Jira, Figma, Miro, and Slack
• Have 7+ years of relevant experience, preferably in product management
• Bring experience in cybersecurity, MDR preferred 

Statutory Pay Disclosure 

The anticipated salary range for this role is $145,500 - $174,000 + stock options + benefits. Actual compensation may vary from posted hiring range based upon geographic location, work experience, education, and/or skill level.

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.;
• A lawful permanent resident of the United States; 
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment. 

Security Analyst II (Weekday Afternoons)

Hybrid, Tampa, FL

• Training schedule: (first 45 to 60 days)
  -Monday and Friday (Remote) - 9AM to 5PM
  -Tuesday, Wednesday & Thursday in the office - 9AM to 5PM
• Upon completion of training:
  - Monday and Friday (Remote) - 2PM-10PM
  - Tuesday, Wednesday and Thursday in the office - 2PM-10PM

Deepwatch is looking for a highly motivated, self-driven, technical analyst dedicated to making a difference in global security by protecting organizations against the most advanced attackers in the world. The Deepwatch Security Operations Center offers opportunities to expand your skill set through a wide variety of experiences, detecting and responding to incidents as they occur in real-time for our customers. 

The Deepwatch Security Operations Center is a unique approach to how we support our customers and ultimately provide an experience not found anywhere else. You’ll be an integral part of supporting our customers by understanding their bespoke environment, needs and challenges. You will be playing a key role in supporting some of the top organizations in the world, and have the opportunity to develop your skills by working with the best responders in the industry, your team and your shift !

In this role, you’ll get to:

• Support incident handling processes across multiple platforms and security technologies including Windows, Linux and macOS
• Provide in depth analysis from escalated requests originating from Security Analyst 1
• Validate suspicious events by performing investigations using SIEM and SOAR technologies, leveraging Deepwatch proprietary tooling, intelligence and OSINT, TTPs and IOCs
• Identify gaps in customer environments, data ingested or configuration errors which reduce telemetry quality
• Work with customer and leadership to surface and resolve concerns
• Provide support to Security Analyst I including coaching and training as necessary
• Leverage your knowledge of Alert Triage, SOC Operations, and Defense in Depth (DiD) to contribute to projects for overall customer success
• Produce high-quality written and verbal communications, recommendations, and findings to customer management in a timely manner
• Surface opportunities for improvement in the SOC and for the customer and be a change agent for measurably improving our customer security posture and experience
• Continue to sharpen your skills and capabilities on the job, and through the Deepwatch development program

To be successful in this role you’ll need to:

• Experience as an analyst in Security Operations Center; MSSP environment preferred
• Have a strong understanding of cyber security principles, concepts and practices including the ability to perform a complete and thorough incident investigation and triage with limited support 
• Know your way around SIEM platforms (Splunk required, Google SecOps or Microsoft Sentinel preferred), how to perform queries and leverage various log sources to perform investigations
• Competency with in-depth header analysis, hashes and Windows/macOS/Linux logs
• Demonstrate the ability to pivot to other log sources, cloud systems or consoles to perform a comprehensive analysis from multiple data sources
• Have a basic understanding of modern EDR, email security and cloud identity platforms
• A desire to support others and uplift the program and team through updating training materials and SOPs
• Strong written and verbal communication skills including the ability to compose detailed reports and analysis that’s thorough, accurate and complete
• Experience with ticketing systems, ServiceNow preferred
• Sec+, CySA, CEH, GSEC, or equivalent certification preferred

Statutory Pay Disclosure:

The anticipated salary range for this role is $77,500 - $97,000 + stock options + benefits. Actual compensation may vary from posted hiring range based upon geographic location, work experience, education, and/or skill level.

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.;
• A lawful permanent resident of the United States; 
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.