> Markdown version of [/jobs/ext/4546544-team-lead-threat-detection-incident-response-tdir](https://www.wearedevelopers.com/jobs/ext/4546544-team-lead-threat-detection-incident-response-tdir). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Team Lead, Threat Detection & Incident Response (TDIR)

- **Company:** Lear Corporation
- **Location:** Southfield, MI, United States
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Cloud Computing, Cyber Security, Database Queries, Digital Forensics, Intelligence Analysis, Intrusion Detection and Prevention, Python (Programming Language), Windows PowerShell, Security Information and Event Management, Scripting, Cloud Platform System, Mitre Att&ck, Mttr, Cyber Threat Analysis, Splunk
- **Published:** November 3, 2026
- **Apply:** https://jobs.lear.com/talentcommunity/apply/1453574633/?locale=en_US

## About the Role

* 7+ years of experience in security operations, incident response, threat detection or digital forensics.
 * 2+ years leading or mentoring others (team lead, shift lead, senior analyst with formal mentoring responsibility, or similar).
 * Deep, hands-on incident response experience across endpoint, identity, email and cloud environments.
 * Strong working knowledge of EDR and SIEM platforms, including writing queries and detections.
 * Experience working with or overseeing an MSSP/MDR provider.
 * Solid understanding of MITRE ATT&CK, the IR lifecycle and the application of threat intelligence to detection and response.
 * Excellent written and verbal communication, with the ability to brief both technical teams and leadership.
 * Comfortable working with a global team and occasionally adjusting hours to support other time zones and active incidents.

Bonus If You Have

 * Experience in manufacturing, automotive or other large, global enterprise environments, including OT exposure.
 * Scripting/automation skills (PowerShell, Python) and SOAR experience.
 * Experience managing vendor relationships, SLAs and QBRs.
 * Experience building playbooks, training programs or analyst development plans.

Experience with Any of the Following Is a Strong Plus

 * EDR / XDR: CrowdStrike Falcon (Insight, Spotlight and Identity)
 * SIEM: Splunk / Splunk Cloud (SPL, custom detection development), * GIAC: GCIH, GCFA, GCIA, GCTI or GNFA
 * CISSP or CISM
 * CompTIA CySA+ / CASP+
 * Vendor certifications (e.g., CrowdStrike CCFR/CCFH, Splunk Certified Power User/Admin)

## Description

We are looking for an experienced Team Lead to help guide our global Threat Detection & Incident Response (TDIR) team. The team is a Tier 2+ function that handles escalations from our 24/7 Managed Security Services Provider (MSSP), leads incident response, performs digital forensics, conducts cyber threat intelligence analysis, and owns the security platforms that power our detection program. This is a hands-on leadership role. You'll be the team's go-to technical and process escalation point, mentor team members across three regions, run key team rhythms, and take ownership of platform health and vendor relationships. You'll work closely with the TDIR Manager and play a central part in how the team operates, grows and scales., * Act as the primary technical escalation point for complex investigations, guiding engineers on where to look, what to collect and whom to engage.

 * Lead or coordinate response to significant security incidents, including containment, eradication, recovery, stakeholder communication and post-incident reviews.

 * Define, maintain and improve IR processes, playbooks and runbooks aligned with frameworks such as NIST SP 800-61 and MITRE ATT&CK.
 * Communicate process changes clearly across regions and ensure procedures are followed during incidents.
 * Track and report operational metrics (e.g., MTTD/MTTR, escalation quality, detection coverage) and recommend improvements.

 * Own the health, adoption and continuous tuning of the team's security platforms (EDR, SIEM, email security, threat intelligence, and related tooling).
 * Keep detections and configurations current with emerging threats; manage upgrades, integrations and use-case roadmaps.
 * Ensure platforms are properly documented and that knowledge is shared across the team to avoid single points of failure.

 * Serve as a primary point of contact for the MSSP and key security vendors, ensuring services meet agreed SLAs and organizational expectations.
 * Participate in Quarterly Business Reviews (QBRs), product reviews and service improvement plans, and drive resulting action items through completion.