Director of Detection and Response

Harvey is building AI-native software for professional services. The Director of Detection and Response will build and lead the team that identifies threats, responds decisively to incidents, and turns what is learned into stronger defenses. The role owns Harvey's Detection and Response strategy, technical direction, and operational readiness across the production platform and corporate environment, working with the CISO and leaders across Engineering, Infrastructure, IT, Legal, and Customer Trust. It is a technical leadership role.

Responsibilities

Build and lead the detection and response organization, hiring and developing detection engineers, incident responders, and technical leaders; Own incident response and crisis readiness, leading responses to major security incidents and building severity criteria, escalation paths, playbooks, and 24/7 coverage; Build detection as an engineering capability, setting technical direction for telemetry, detection pipelines, forensic tooling, and response automation; Focus defenses on meaningful threats using threat intelligence, hunting, and attacker perspective, and partner with offensive security and platform owners to close blind spots; Make response a company capability by partnering with Engineering, IT, Legal, Privacy, Communications, and Customer Trust on sensitive investigations and crisis decisions; Turn incidents into lasting improvements through blameless reviews, corrective actions, and measurement of detection coverage and response times

Requirements

Experience building and leading Detection and Response, incident response, or security engineering teams in a technology company with complex production systems; A record of hiring strong engineers, developing technical leaders, and scaling both the team and its operating model; Deep incident response experience and demonstrated judgment during serious security events; Ability to lead investigations with incomplete information, make timely containment decisions, and communicate clearly with executives, engineers, and business partners; Strong technical foundations in cloud infrastructure, operating systems, networking, identity, and attacker tradecraft, with depth in detection engineering, threat hunting, or digital forensics; Engineering approach to security operations, backed by experience building detection platforms, investigation tools, or response automation; Ability to evaluate architecture and code, guide senior engineers, and make practical build, buy, or retire decisions; Ability to turn business risk into a focused strategy and deliver it through influence and partnership; Ability to balance urgent response with long-term engineering work

Nice to have

Experience protecting enterprise SaaS, sensitive customer data, or AI/ML environments; Experience investigating insider threats; Experience partnering on privileged-access governance; Experience leading response under regulatory and public scrutiny