Manager, Threat Intelligence
Leader who owns threat intelligence, threat hunting, and detection engineering for PDI's SOC — managing a team of four while also hunting, writing intel, and building detections that protect 12,000+ convenience retail and petroleum customers. Core stack: SIEM (FortiSIEM), EDR/XDR, MITRE ATT&CK, KQL/SPL.
- Compensation
- Not disclosed
- Location
- Remote US
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- 8+ years in cybersecurity across threat intelligence, threat hunting, incident response, detection engineering, or security operations
- 3+ years managing technical security teams, including hiring and developing people
- Deep knowledge of adversary tactics and frameworks such as MITRE ATT&CK, the intelligence lifecycle, and the Diamond Model
- Track record of producing finished intelligence for both technical and executive audiences
- Hands-on experience with SIEM (FortiSIEM, Microsoft Sentinel, Splunk, Google Chronicle, or ArcSight) and EDR/XDR platforms and their query languages (KQL, SPL, or similar)
- Experience supporting complex investigations and incident response
- Excellent written, verbal, and presentation communication skills, translating technical findings into business risk
- Bachelor's degree in a related field or equivalent experience
Nice to have
- Experience at an MSSP or MDR provider serving many customers
- Background in retail, hospitality, or payments environments, including POS systems or PCI DSS
- Detection-as-code, Sigma, SOAR, or scripting (e.g., Python)
- Experience with threat intelligence platforms and feeds, such as MISP or Recorded Future
- Cloud and SaaS investigations across Azure, AWS, or Microsoft 365
- Active involvement in intelligence-sharing communities such as RH-ISAC
- Certifications such as GCTI, GCFA, GCIH, GREM, or CISSP
Full description
At PDI Technologies, we empower some of the world's leading convenience retail and petroleum brands with cutting-edge technology solutions that drive growth and operational efficiency. By “Connecting Convenience” across the globe, we empower businesses to increase productivity, make more informed decisions, and engage faster with customers through loyalty programs, shopper insights, and unmatched real-time market intelligence via mobile applications, such as GasBuddy. We’re a global team committed to excellence, collaboration, and driving real impact. Explore our opportunities and become part of a company that values diversity, integrity, and growth.
Every day, millions of people buy fuel, coffee, and lunch at the businesses PDI protects. Convenience stores, fuel stations, quick-service restaurants, and automotive businesses run on payment systems, point-of-sale networks, and connected site equipment, and financially motivated attackers know it.
We're looking for an experienced leader to own threat intelligence, threat hunting, and detection engineering for our SOC. You'll build the clearest picture anywhere of who targets these industries and how, then turn it into detections, hunts, and guidance that protects 12,000+ customers.
This isn't an internal intel team serving one company. Your team's work ships to every customer we protect, and you'll have real room to build the program the way you think it should run.
Why this role stands out
- A threat landscape you can own. Payment card theft, POS malware, ransomware against franchise networks, and attacks on connected forecourt and in-store systems. Few teams anywhere specialize here.
- A straight line from intel to impact. Your team writes the intelligence and the detections. You'll see your work stop real attacks across many customer environments.
- Room to build. Shape the methodology, tooling, and AI-assisted workflows rather than inheriting someone else's playbook.
- Visibility. Brief customer executives, partner with SOC, product, and company leaders, and represent PDI in industry and intelligence-sharing communities.
What you'll own
Lead and grow the team
- Hire, coach, and develop a remote team of analysts, hunters, and detection engineers, with clear priorities and career paths.
- With a team of four, you'll split your time between leading and doing: hunting, writing intelligence, and building detections alongside the team.
- Partner with SOC, Incident Response, and Security Engineering leaders to improve detection, response, and customer outcomes.
Build the intelligence program
- Define intelligence requirements with SOC leadership and customers and run the full intelligence lifecycle from collection through feedback.