Head of Detection and Response

About the role

The Head of Detection & Response leads Atlassian’s global incident detection, response, threat intelligence, and security operations programs. This senior security engineering leader shapes strategy and drives measurable outcomes across cloud‑first environments to protect customers at scale.

Key responsibilities

• Own the global detection and response strategy, roadmap, and investment plan, linking security outcomes to business risk and customer trust metrics.
• Scale cloud‑native detections across identity, data, endpoints, CI/CD, containers, and SaaS using telemetry and modern rule engines.
• Operate a 24x7 incident response function with automation, playbooks, executive communications, and regulatory readiness.
• Build an intel‑fusion capability that turns external and internal signals into prioritized detections and pre‑emptive controls.
• Partner with Trust Engineering to evolve the security data platform, ensuring privacy‑aware telemetry and leveraging ML/LLM‑assisted detections responsibly.
• Represent Detection & Response in executive forums, customer escalations, and external audits, providing transparent evidence of security posture.

Required profile

• 15+ years in security, with 7+ years leading multi‑region detection/response or SOC/IR organizations at large‑scale cloud‑first companies.
• Proven track record handling high‑severity incidents end‑to‑end, including executive and customer communications and regulatory readiness.
• Deep expertise in cloud platforms, identity, modern endpoint/EDR, data security, CI/CD security, and SaaS telemetry integration.
• Experience deploying automation (SOAR) and delivering measurable improvements in MTTD/MTTR with clear KPIs and SLOs.
• Executive presence with board‑level communication experience and ability to simplify complex incidents.

Required skills

• Cloud‑native detection engineering
• Identity and access management
• Data security and protection
• Endpoint Detection and Response (EDR)
• CI/CD security and pipeline integration
• Container security
• SaaS telemetry collection and analysis
• Machine Learning and Large Language Model (LLM) assisted detection
• Security Orchestration, Automation and Response (SOAR)
• Threat intelligence fusion and threat hunting
• ATT&CK framework and purple‑team methodologies