State Street is seeking a senior, hands-on Technical Security Lead to help evolve critical security platforms that enable enterprise threat detection, incident response, threat hunting, vulnerability management, and insider-risk investigations.

You will help set the technical direction for a strategic portfolio centered on enterprise endpoint detection and response, extended detection and response, security automation, and orchestration capabilities.

You will partner with cybersecurity teams, enterprise technology partners, and vendors to build resilient, scalable, and measurable capabilities that help the organization identify, investigate, contain, and respond to cyber threats faster.

This role offers the opportunity to deepen expertise in modern security platforms, expand technical influence, and contribute to security capabilities that will continue to mature over time.

This is a senior individual-contributor technical role with enterprise-wide exposure and meaningful responsibility within a strategic security-platform portfolio. It does not include direct people-management responsibility.

Why This Role Is Important to Us

In this position, you will help shape the technology foundation of State Street’s Cyber Fusion Center. The capabilities you help build will directly improve how teams detect threats, reduce response friction, and operate more consistently during security events.

The role also helps the organization responsibly adopt AI-driven security capabilities while addressing emerging risks tied to the use and misuse of AI technologies across the enterprise.

You will work directly with detection engineering, incident response, threat hunting, vulnerability management, insider-risk, infrastructure, identity, cloud, and technology teams to turn operational challenges into durable technical capabilities.

What You Will Be Responsible For

Contribute to the architecture, roadmap, lifecycle, standards, reliability, and resilience of enterprise security platforms and related integrations.

Design and maintain security automation workflows, playbooks, and API integrations across key security, IT, identity, cloud, and threat-intelligence platforms.

Evaluate, implement, and tune AI-driven detection and automation capabilities while helping address AI-related security risks.

Partner with Cyber Fusion Center teams to automate high-value work, reduce manual handoffs, standardize workflows, and improve response consistency.

Support security platform initiatives from discovery, evaluation, and roadmap planning through design, rollout, adoption, and continuous improvement.

Measure platform health and operational impact, including coverage, telemetry quality, workflow reliability, automation success, and response effectiveness.

Provide technical mentorship, contribute to architecture and risk decisions, and communicate clearly with technical and nontechnical partners.

What We Value

The strongest candidates will bring curiosity, practical judgment, and a bias for building reliable solutions that make security teams more effective.

A practical, hands-on approach to understanding security tools, their use cases, and their operational limitations.

Sound security judgment and the ability to work through complex technical and operational trade-offs.

Curiosity about the threat landscape, attacker behaviors, and the ways security teams can improve detection, response, and resilience.

Calm, reliable execution in time-sensitive security situations where speed, clarity, and follow-through matter.

Collaboration across technical and nontechnical teams.

A practical automation mindset with the ability to identify repetitive work, preserve human judgment where needed, and build reliable workflows that improve speed and consistency without unnecessary risk.

The ability to prioritize effectively and communicate clearly during incidents and other time-sensitive work.

A commitment to building dependable, well-documented, and scalable security capabilities while continuing to grow technical depth and mentor others through shared standards and practices.

Education & Qualifications

We encourage candidates with strong adjacent experience to apply, even if their background does not match every platform or technology area listed.

Required Qualifications

Typically, 7+ years of relevant experience in cybersecurity engineering, security operations, detection engineering, security-platform engineering, or a related field; equivalent depth of experience will be considered.

Hands-on experience engineering and optimizing enterprise endpoint detection and response or extended detection and response platforms.

Hands-on experience designing, operating, and integrating security automation or orchestration workflows using APIs, webhooks, scripting, or similar methods.

Experience delivering security technology into operational security environments, including SOC, incident response, threat hunting, or detection engineering teams; 24/7 operations experience is a plus.

Ability to translate operational security needs into scalable technical solutions and clearly communicate decisions, risks, and trade-offs.

Preferred Qualifications

Experience with Python, PowerShell, REST APIs, JSON, data transformation, and infrastructure or configuration automation.

Experience building security-operations workflows for enrichment, investigation, containment, notification, evidence collection, and reporting.

Experience integrating and improving endpoint-security programs, including platform integrations, deployment, coverage, telemetry quality, policy management, health monitoring, and reporting.

Familiarity with MITRE ATT&CK and detection-engineering practices, including development, testing, tuning, and lifecycle management.

Hands-on experience operationalizing AI-driven security features or developing controls for AI-related insider-threat and data-security risks.

Experience in a highly regulated environment, including financial services.

Relevant security, cloud, automation, endpoint-security, or vendor-neutral technical certifications.

Location & Work Arrangement

This role is based in Quincy or Boston, MA, and follows a hybrid work model that includes regular in-office days.

The team supports 24/7 security operations; participation in an on-call rotation is required.