Engineering Manager I, Threat Detection

As Engineering Manager for Threat Detection, you will lead a high-performing team that powers Datadog's detection program. Threat Detection is the organization responsible for keeping Datadog ahead of an evolving threat environment: closing coverage gaps faster, raising the bar on signal quality, and shipping detections that hold up under the scale and complexity of cloud-native infrastructure. Your team will combine direct detection expertise, platform engineering, and applied AI to ship detections at a pace and scale traditional rule-writing alone cannot match. Examples of what your team will work on include detection-authoring agents, the detection platform that powers every rule in production, coverage analysis, alert triage and response automation, and the evaluation infrastructure that holds these systems to a high bar of fidelity. Detection authorship is a shared responsibility across the organization, and your team will contribute both by building the systems that scale our authoring capacity and by writing detections directly when their domain expertise is the right tool. You will partner closely with our Security Incident & Response Team (SIRT), Cyber Threat Intelligence (CTI), AI Engineering teams, and Datadog's broader Security organization. This is a high-impact leadership role: you will grow a team of security and software engineers responsible for building and [... source excerpt omitted ...] ’ll Do: Lead the strategy, roadmap, and execution of Datadog Security's shift to AI-accelerated detection and response. Drive development of high-fidelity detections as a shared responsibility across the organization, ensuring your team's systems and direct contributions raise the bar on coverage and signal quality. Build, mentor, and grow a high-performing team of engineers tackling the hardest problems in threat detection at scale. Partner with sister teams across Threat Detection and the broader Security organization so your team's deliverables integrate reliably with the rest of the program. Define and track program metrics: detection coverage, signal quality, model and agent [... source excerpt omitted ...] You have prior experience at a SaaS or cloud infrastructure company where security scale and complexity are first-order challenges. You operate with both rigor and pragmatism on production quality. You know when to ship a useful system, when to invest in further evaluation, and when not to ship at all. Experienced people leader with a focus on mentorship, team growth, and inclusion. Nice to haves: You have led or sponsored threat hunts that drove lasting improvements in detection coverage. You have translated security research, threat intelligence, or analyst workflows into engineered systems. You have designed or operated detection platforms: SIEM pipelines, detection-as-co