Team Lead – Threat Detection & Incident Response - Tdir

Lear For You

We work hard for the people who work for us. We champion our teams and foster collaboration, inclusion, respect and excellence. Because we want to be more for you.

A path to a better career. A better future.

Our teams have invented groundbreaking technologies, manufactured millions of products and earned a long list of awards. Year after year, we’re named one of the World’s Most Admired Companies.

They’re the secret to our success—empowered, inventive and inclusive. Passionate about their craft. Driven to succeed. Because we win together.

Are you ready for a better career? A better future?

Job Description

We are looking for an experienced Team Lead to help guide our global Threat Detection & Incident Response (TDIR) team. The team is a Tier 2+ function that handles escalations from our 24/7 Managed Security Services Provider (MSSP), leads incident response, performs digital forensics, conducts cyber threat intelligence analysis, and owns the security platforms that power our detection program. This is a hands-on leadership role. You'll be the team's go-to technical and process escalation point, mentor team members across three regions, run key team rhythms, and take ownership of platform health and vendor relationships. You'll work closely with the TDIR Manager and play a central part in how the team operates, grows and scales.

Responsibilities

• Act as the primary technical escalation point for complex investigations, guiding engineers on where to look, what to collect and whom to engage.
• Lead or coordinate response to significant security incidents, including containment, eradication, recovery, stakeholder communication and post-incident reviews.

• Define, maintain and improve IR processes, playbooks and runbooks aligned with frameworks such as NIST SP 800-61 and MITRE ATT&CK.
• Communicate process changes clearly across regions and ensure procedures are followed during incidents.
• Track and report operational metrics (e.g., MTTD/MTTR, escalation quality, detection coverage) and recommend improvements.

• Own the health, adoption and continuous tuning of the team's security platforms (EDR, SIEM, email security, threat intelligence, and related tooling).
• Keep detections and configurations current with emerging threats; manage upgrades, integrations and use-case roadmaps.
• Ensure platforms are properly documented and that knowledge is shared across the team to avoid single points of failure.

• Serve as a primary point of contact for the MSSP and key security vendors, ensuring services meet agreed SLAs and organizational expectations.
• Participate in Quarterly Business Reviews (QBRs), product reviews and service improvement plans, and drive resulting action items through completion.

Your Qualifications

• 7+ years of experience in security operations, incident response, threat detection or digital forensics.
• 2+ years leading or mentoring others (team lead, shift lead, senior analyst with formal mentoring responsibility, or similar).
• Deep, hands-on incident response experience across endpoint, identity, email and cloud environments.
• Strong working knowledge of EDR and SIEM platforms, including writing queries and detections.
• Experience working with or overseeing an MSSP/MDR provider.
• Solid understanding of MITRE ATT&CK, the IR lifecycle and the application of threat intelligence to detection and response.
• Excellent written and verbal communication, with the ability to brief both technical teams and leadership.
• Comfortable working with a global team and occasionally adjusting hours to support other time zones and active incidents.

Bonus If You Have

• Experience in manufacturing, automotive or other large, global enterprise environments, including OT exposure.
• Scripting/automation skills (PowerShell, Python) and SOAR experience.
• Experience managing vendor relationships, SLAs and QBRs.
• Experience building playbooks, training programs or analyst development plans.

Experience with Any of the Following Is a Strong Plus

• EDR / XDR: CrowdStrike Falcon (Insight, Spotlight and Identity)
• SIEM: Splunk / Splunk Cloud (SPL, custom detection development)
• Email Security: Proofpoint
• Threat Intelligence: Recorded Future
• MDR Model: 24/7 MSSP Level 1 triage with in-house Tier 2+ response

Certifications – Preferred, Not Required

• GIAC: GCIH, GCFA, GCIA, GCTI or GNFA
• CISSP or CISM
• CompTIA CySA+ / CASP+
• Vendor certifications (e.g., CrowdStrike CCFR/CCFH, Splunk Certified Power User/Admin)

Equal Opportunity Employer

Lear Corporation is committed to fair, merit‑based employment practices and equal opportunity.

We provide reasonable accommodations in accordance with applicable law. For assistance during the application process, contact your recruiter directly.

Applicants must submit their resume for consideration using our applicant tracking system. Due to the high volume of applications received, only candidates selected for interviews will be contacted. Candidates must be legally authorized to work in the country where the position is located. Unsolicited resumes from search firms, employment agencies, or similar, will not be paid a fee and will become the property of Lear Corporation.