Director of Forward Deployed Engineering

About the Role

TENEX.AI is the AI-native, human-led MDR provider. This Director owns the foundational delivery of our MDR service: how we build, deploy, manage, and integrate the platforms our service runs on: Google SecOps, Microsoft Sentinel, and the Tenex Platform. The mandate is time-to-protection and repeatable, high-quality multi-SIEM delivery at scale, standing platforms up cleanly, wiring in the customer's data and tooling, operationalizing detection content and context, and keeping it all running well across the portfolio.

This is an engineering leadership role, not an advisory or product-building one. The team implements and manages the platforms and works closely with the teams that deliver advisory engagements and develop agentic use cases; deploying and integrating what they produce and relaying field context back to them.

What You'll Do

• Own time-to-protection across our supported platforms - the speed and repeatability of standing up Google SecOps, Microsoft Sentinel, and the Tenex Platform in customer environments for example.
• Lead multi-SIEM engineering - build, deploy, and manage pipelines, parsers, detections, playbooks and other configuration across Google SecOps, Microsoft Sentinel, and the Tenex Platform.
• Own integrations - data-source onboarding, connector/API work, and normalization that wire the customer's environment and security tooling into the SIEMs and the Tenex Platform; build integration patterns that get reused, not rebuilt.
• Own context engineering - the data mappings, entity resolution, tuning, and environment knowledge that make the platforms actually perform per customer.
• Own ongoing platform management - health, optimization, and lifecycle of deployed platforms across the book of business.
• Build the repeatable delivery machine - playbooks, intake, quality gates, and a capacity model that let the team scale against pipeline instead of heroics.
• Lead and scale the team - hire, coach, and develop the engineers responsible for platform implementation, content, and integration; manage capacity against the customer pipeline; own delivery quality, SLOs, and OKRs.
• Run the cross-team interfaces - partner with customer success, product management, threat intelligence, and cyber defense across the delivery lifecycle, and maintain clean support/relay channels with the advisory and agentic engineering functions.

Must-have

• 8+ years in security engineering, security operations, or detection engineering, with 3+ years managing engineers (ideally managing leads/managers).
• Hands-on depth across both major SIEMs: Google SecOps (Chronicle - ingestion, parsers/CBN, YARA-L, entity graph) and Microsoft Sentinel (KQL, analytics rules, data connectors, Log Analytics) - or deep in one and strongly credible in the other, with clear ability to lead both.
• Integration engineering - data-source onboarding, connector/API development, and normalization across platforms.
• Demonstrated track record building repeatable delivery at scale - playbooks, quality gates, capacity planning - not just running individual projects.
• Strong customer-facing communication; can own a delivery relationship with a customer security team.
• Comfort with multi-tenant delivery and content-as-code / CI/CD workflows.

Nice-to-have

• SOAR / automation (Chronicle SOAR, Sentinel automation rules & playbooks).
• Pipeline and telemetry tooling (Bindplane, Logstash, or equivalent).
• Terraform / IaC for repeatable environment standup.
• Prior MSSP / MDR / managed security services experience.
• Experience operating alongside agentic and advisory functions without absorbing their scope.

What Success Looks Like

• 90-day: Multi-SIEM delivery playbooks and quality gates in place. Time-to-protection baseline measured across SecOps and Sentinel deployments. Team capacity model built against pipeline. Support/relay interfaces with the advisory and agentic engineering functions defined and agreed.
• 6-month: Measurable reduction in time-to-protection across both SIEMs. Integration patterns reused rather than rebuilt. Ongoing platform management running to a defined health/optimization cadence. Team staffed to plan.
• 12-month: A repeatable, metric-driven multi-platform delivery machine that scales sub-linearly to customer growth. Managed platforms healthy across the book. The "we support, they own" interfaces to the advisory and agentic engineering functions running smoothly, with no scope drift in either direction.

Education & Certifications

• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field (or equivalent practical experience)
• Relevant certifications such as CISSP, CISM, GIAC certifications, Google Cloud Professional, Microsoft SC-200/AZ-500, or AWS Certified Solutions Architect are a plus