Director, Detection & Threat Response

At Allstate, great things happen when our people work together to protect families and their belongings from life’s uncertainties. And for more than 90 years, our innovative drive has kept us a step ahead of our customers’ evolving needs. From advocating for seat belts, air bags and graduated driving laws, to being an industry leader in pricing sophistication, telematics, and, more recently, device and identity protection.

Job Description

The Director, Detection & Threat Response is the enterprise’s senior leader for intelligence-led detection and response. The role is accountable for how Allstate anticipates, finds, and stops adversaries before they affect customers, data, or operations. This leader sets the strategic direction for three global functions: D&R Engineering & Automation, Threat Intelligence, and Threat Hunting. The goal is to unite them into one system in which intelligence sets priorities, hunting tests those priorities against the environment, detections are engineered and shipped as code, and response runs at machine speed under clear governance.

As a Director, you won’t just deliver results – you drive our culture and shared purpose. You can work remotely and will commute to a nearby office and/or travel for meaningful connection opportunities.

Imagine this.

• 7:02 a.m. A new intelligence report describes an MFA-bypass technique being used against financial services firms. Within two minutes it is scored against Allstate’s priority intelligence requirements and flagged as relevant, and an automated hunt launches across identity and email telemetry.

• 7:09 a.m. The hunt gets a hit: one account shows the technique’s pattern. An AI agent opens the investigation immediately, pulls identity and device context, runs the pivots a senior analyst would run, and reaches a high-confidence verdict with a full evidence trail.

• 7:11 a.m. Contained. The verdict meets the bar for a pre-approved, reversible response, so the system acts on its own: active sessions revoked, credentials reset, account temporarily locked. Nine minutes from first intelligence to containment.

• 7:16 a.m. An analyst reviews the evidence and the actions taken, confirms the call, and reaches out to the employee. Humans stay accountable for every automated action, without being the bottleneck for it.

• 8:02 a.m. An AI-drafted detection for the technique is waiting in an engineer’s review queue. It uses the real attack telemetry from the hunt as its test case, and has been backtested against 30 days of history for false positives. It arrives linked to the intelligence that prompted it, the attack path it closes, and its expected alert volume. The engineer approves it and the pipeline promotes it. Next time, nobody has to go hunting. It fires on its own.

Now imagine you lead the teams that made that possible. Your intelligence team set the priority. Your hunters tested it against our environment. Your engineers built the automation that contained it in minutes and the pipeline that turned it into durable coverage within the hour. And you know it worked because you inspected the data, not because someone said so.

That’s the job, and it’s what we’re building at Allstate.

What we’re building

Allstate is building a Cyber Response organization designed for the speed of AI-enabled threats. The work underway is the kind most security teams are still only talking about:

• An AI-assisted detection-as-code pipeline. Every detection version-controlled, peer-reviewed, tested, tied to the attack paths that matter most to Allstate, and promoted through CI/CD, with AI agents accelerating how detections are created and validated.

• Agentic investigation and governed response. AI-driven triage and investigation paired with orchestrated response, with human decision gates where the business impact is real.

• Automated threat intelligence. Pipelines that turn global threat reporting into fast, relevant action for exposure management, incident response, hunting, and leadership.

• Intelligence-led threat hunting. Hypothesis-driven hunts, AI-assisted scoping, and findings that flow straight into durable detections.

• Continuous adversarial validation. Breach-and-attack simulation and purple teaming that prove coverage against real attacker behavior.

We need a leader who can bring these together into one system and take it to enterprise scale.

Why this matters

Allstate exists to protect people from life’s uncertainties. In security, that promise now runs into a math problem: adversaries are using automation and AI to scale, and human hours do not. If analyst capacity decides what we detect, risk ends up in the alerts no one had time to look at. Our goal is to predict, detect, and disrupt threats before they reach our customers and our data, with coverage we can prove, detections we can trust, response at machine speed, and automation we can govern.

What Allstate can do for you

• A charter, not a backlog. You’ll lead three teams, D&R…