Director of Forward Deployed Engineering

TENEX.AI provides AI-native, human-led managed detection and response services. The Director of Forward Deployed Engineering leads the engineering team and owns the implementation, integration, and ongoing management of multi-SIEM platforms, building repeatable delivery practices that improve time-to-protection at scale.

Responsibilities:

• Own time-to-protection across our supported platforms — the speed and repeatability of standing up Google SecOps, Microsoft Sentinel, and the Tenex Platform in customer environments for example
• Lead multi-SIEM engineering — build, deploy, and manage pipelines, parsers, detections, playbooks and other configuration across Google SecOps, Microsoft Sentinel, and the Tenex Platform
• Own integrations — data-source onboarding, connector/API work, and normalization that wire the customer's environment and security tooling into the SIEMs and the Tenex Platform; build integration patterns that get reused, not rebuilt
• Own context engineering — the data mappings, entity resolution, tuning, and environment knowledge that make the platforms actually perform per customer
• Own ongoing platform management — health, optimization, and lifecycle of deployed platforms across the book of business
• Build the repeatable delivery machine — playbooks, intake, quality gates, and a capacity model that let the team scale against pipeline instead of heroics
• Lead and scale the team — hire, coach, and develop the engineers responsible for platform implementation, content, and integration; manage capacity against the customer pipeline; own delivery quality, SLOs, and OKRs
• Run the cross-team interfaces — partner with customer success, product management, threat intelligence, and cyber defense across the delivery lifecycle, and maintain clean support/relay channels with the advisory and agentic engineering functions

Requirements:

• 8+ years in security engineering, security operations, or detection engineering, with 3+ years managing engineers (ideally managing leads/managers)
• Hands-on depth across both major SIEMs: Google SecOps (Chronicle — ingestion, parsers/CBN, YARA-L, entity graph) and Microsoft Sentinel (KQL, analytics rules, data connectors, Log Analytics) — or deep in one and strongly credible in the other, with clear ability to lead both
• Integration engineering — data-source onboarding, connector/API development, and normalization across platforms
• Demonstrated track record building repeatable delivery at scale — playbooks, quality gates, capacity planning — not just running individual projects
• Strong customer-facing communication; can own a delivery relationship with a customer security team
• Comfort with multi-tenant delivery and content-as-code / CI/CD workflows
• Bachelor's degree in Computer Science, Cybersecurity, Engineering, or a related field (or equivalent practical experience)
• SOAR / automation (Chronicle SOAR, Sentinel automation rules & playbooks)
• Pipeline and telemetry tooling (Bindplane, Logstash, or equivalent)
• Terraform / IaC for repeatable environment standup
• Prior MSSP / MDR / managed security services experience
• Experience operating alongside agentic and advisory functions without absorbing their scope
• Relevant certifications such as CISSP, CISM, GIAC certifications, Google Cloud Professional, Microsoft SC-200/AZ-500, or AWS Certified Solutions Architect are a plus