Senior Manager Purple Team

- Purple Team Program Leadership: Define and execute the strategic vision for Vanguard's Purple Team program, aligning threat-informed defense validation activities to enterprise cyber risk priorities. Develop annual roadmaps that prioritize adversary emulation, detection validation, control effectiveness testing, and threat-informed exercises based on intelligence, prior offensive operations, and evolving industry threats.

- Team Management & Development: Lead and develop a geographically distributed team of Purple Team operators focused on adversary emulation, detection validation, and defensive capability improvement. Drive hiring, coaching, mentoring, and career development while fostering a culture of continuous learning, innovation, and collaboration between offensive and defensive security teams.

- Detection Validation & Threat-Informed Testing: Oversee Purple Team operations that validate security controls, detection content, response playbooks, and investigative procedures across the enterprise. Ensure testing is aligned to known adversary TTPs and frameworks such as MITRE ATT&CK and MITRE ATLAS. Drive repeatable validation methodologies that assess prevention, detection, investigation, and response capabilities.

- Offensive Security Partnership & Remediation Closure: Partner closely with Offensive Security teams to translate findings from Red Team operations, penetration tests, and adversarial AI assessments into Purple Team validation activities. Ensure previously identified detection gaps are remediated, tested, and validated before closure.

Establish feedback loops that improve both offensive and defensive program effectiveness.

- CSOC & Detection Engineering Collaboration: Serve as the primary liaison between OSFT, CSOC, Threat Detection Engineering, Fraud Detection, and Cyber Threat Intelligence teams. Coordinate collaborative exercises that validate new detections, response workflows, telemetry coverage, and security monitoring capabilities.

Drive alignment on adversary emulation priorities and detection engineering roadmaps.

- Reporting & Metrics: Establish measurable metrics to demonstrate security improvement and operational effectiveness. Track and communicate detection coverage, ATT&CK technique validation rates, mean-time-to-detect improvements, detection fidelity, response effectiveness, and remediation progress. Present findings, trends, and strategic recommendations to senior leadership and governance forums.

- Threat Intelligence Integration: Partner with Cyber Threat Intelligence teams to ensure Purple Team exercises emulate relevant financial industry adversaries, fraud threats, ransomware groups, insider threats, and emerging AI-enabled attack techniques. Translate intelligence into actionable validation scenarios that strengthen Vanguard's security posture.

- Strategic Innovation & Program Maturity: Continuously evolve the Purple Team capability by introducing new validation methodologies, automation, adversarial AI testing approaches, cloud-native security validation, attack-path simulation, and continuous control validation capabilities. Drive innovation while ensuring exercises remain aligned with business objectives and risk priorities.

- Purple Team & Detection Expertise: 10+ years of experience in cybersecurity with significant experience in Purple Teaming, Detection Engineering, Threat Hunting, Incident Response, Red Teaming, or Adversary Simulation. Deep understanding of attacker methodologies, detection technologies, security telemetry, and defensive operations.

- Leadership & Program Management: 3+ years leading security teams, Purple Team programs, Detection Engineering functions, Incident Response capabilities, or equivalent technical organizations. Demonstrated ability to develop teams, manage strategic initiatives, and deliver measurable cybersecurity outcomes across multiple stakeholders.

- Threat-Informed Defense Expertise: Strong knowledge of MITRE ATT&CK, MITRE ATLAS, adversary emulation methodologies, detection engineering practices, threat hunting frameworks, and modern SOC operations. Experience designing and executing threat-informed validation programs at enterprise scale.

- Security Operations & Detection Engineering Knowledge: Deep familiarity with SIEM, EDR, NDR, cloud security monitoring, threat intelligence platforms, deception technologies, automation workflows, and modern detection engineering practices. Experience evaluating detection coverage and improving security monitoring effectiveness.

- AI & Automation Familiarity: Experience leveraging AI/ML technologies, automation frameworks, and security analytics to enhance threat detection, adversary simulation, or security operations. Understanding of how generative AI impacts both attacker tradecraft and defensive capabilities.

- Cross-Functional Leadership & Communication: Exceptional communication and stakeholder management skills with the ability to influence technical teams, security leadership, and executive stakeholders. Proven experience driving collaboration across Offensive Security, CSOC, Fraud, Risk, Engineering, and Threat Intelligence teams.

- Education & Certifications: Bachelor's degree in Computer Science, Cybersecurity, or related discipline (or equivalent experience). Relevant certifications (e.g., CISSP, GCFA. GCTI, GMON, GCIA, CRTO, CARTP, OSCP, CREST Certifications) that demonstrate both offensive technical depth and security management knowledge are strongly preferred.