Engineering Manager I, Threat Detection

Datadog · New York, New York, USA · Security · listed May 26, 2026

The shape of it

Seniority
Manager
Where
Hybrid
Stated pay
$192,000 – $240,000 USD
Requirements listed
7
Length
1,113 words

In the posting’s own words

As Engineering Manager for Threat Detection, you will lead a high-performing team that powers Datadog's detection program. Threat Detection is the organization responsible for keeping Datadog ahead of an evolving threat environment: closing coverage gaps faster, raising the bar on signal quality, and shipping detections that hold up under the scale and complexity of cloud-native infrastructure.

What it asks for · 7

  • You have worked in a security operations, detection engineering, or incident response role, building tooling and performing investigations and responding to incidents.
  • Strong understanding of modern threat actor techniques and the detection engineering lifecycle.
  • Technically credible, with the ability to review detection logic, code (e.g., Python), and the architecture of security systems (AI-driven or otherwise).
  • You have built automation systems for security operations workflows: detection platforms, AI-driven detection capabilities, case triage, investigation, response automation, or analyst tooling.
  • You have prior experience at a SaaS or cloud infrastructure company where security scale and complexity are first-order challenges.
  • You operate with both rigor and pragmatism on production quality. You know when to ship a useful system, when to invest in further evaluation, and when not to ship at all.
  • Experienced people leader with a focus on mentorship, team growth, and inclusion.

Also a plus

  • You have led or sponsored threat hunts that drove lasting improvements in detection coverage.
  • You have translated security research, threat intelligence, or analyst workflows into engineered systems.
  • You have designed or operated detection platforms: SIEM pipelines, detection-as-code workflows, CI/CD for security content, or equivalent.
  • You have built observability for detection systems: instrumentation for coverage and drift, false positive analysis, or silent failure detection.
  • You have built and shipped agentic or ML systems to production. You understand the full lifecycle (data, training, evaluation, deployment, monitoring) and have led teams through it.
  • You have designed safety, guardrails, or human-in-the-loop systems for autonomous AI in security domains.

What the job covers

  • Lead the strategy, roadmap, and execution of Datadog Security's shift to AI-accelerated detection and response.
  • Drive development of high-fidelity detections as a shared responsibility across the organization, ensuring your team's systems and direct contributions raise the bar on coverage and signal quality.
  • Build, mentor, and grow a high-performing team of engineers tackling the hardest problems in threat detection at scale.
  • Partner with sister teams across Threat Detection and the broader Security organization so your team's deliverables integrate reliably with the rest of the program.
  • Define and track program metrics: detection coverage, signal quality, model and agent fidelity, evaluation pass rates, incident response readiness, and your team's measurable contribution to security operations outcomes.
  • Evangelize the team's mission inside and outside the Threat Detection organization, communicating progress, tradeoffs, and bets clearly to security leadership and partner teams.
  • Collaborate with the AI Engineering teams and other internal AI initiatives to build on shared infrastructure where it makes sense and invest in security-specific tooling where it does not.

Tools and skills named

Security & compliance
  • Security15×
Cloud & infra
  • Datadog6×
  • CI/CD
  • Observability
Frameworks
  • REST
Go to market
  • SaaS
Languages
  • Python
Models & research
  • Machine learning
Product & design
  • Roadmap
Ways of working
  • Mentorship

Words the posting leans on

  • detection25×
  • security14×
  • systems10×
  • threat10×
  • coverage6×
  • engineering6×
  • organization6×
  • response6×
  • scale5×
  • threat detection5×
  • evaluation4×
  • infrastructure4×
  • platform4×
  • bar3×
  • build3×
  • building3×

Counted from the posting after the mission statement and the legal notices are set aside. The ones near the top are the ones a screener is looking for.

The posting, your resume, and the gaps between them. One click loads all three.

More open at Datadog

every open role at Datadog

How this page was made

An automated read of a public job posting, fetched August 25, 2026 and last changed by Datadog on August 24, 2026. Every list above is pulled from the posting’s own sentences — nothing rewritten, nothing added, no judgment about the role or the company. Counts and seniority are read off the text by rule, so they can be wrong where the posting is unusual. The original is the only thing that binds. Openings close without warning; check the source before spending an evening on it.