Our Purpose Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.

Title And Summary Threat Response Technology and Capabilities Product Owner

Overview The Corporate Security Threat and Response Management product ownership team is looking for a Lead Security Engineer to help drive our Security Operations modernization strategy. The ideal candidate is passionate about the contemporary security tools, capabilities, and strategies. As a Product Owner, you will be defining, owning, and driving the incident response technology and capability strategy across global Security Operations. This role sets the vision for response tooling, automation, AI augmentation, and digital evidence workflows used by regional Security Operations Center (SOC), Digital Forensics Investigation Response (DFIR), and Threat Response teams. The Product Owner is accountable for the end-to-end RESPOND product lifecycle: strategy, roadmap, requirements, build oversight, adoption, and measurable operational outcomes. This is a lead-level, hands‑on product leadership role for a practitioner operating at the bleeding edge of SOC 3.0: AI-assisted triage, agentic response, notebook‑driven investigation, and engineering‑led operations. The successful candidate is equal parts DFIR practitioner, SOAR architect, SOC AI‑augmentation strategist, and product leader.

The Role





Own and execute the multi‑year strategy and roadmap for evolving and scaling incident response capabilities, tooling, automation, and AI augmentation across Security Operations’ function.

Define and maintain the RESPOND capability taxonomy, mapped to NIST CSF (Respond/Recover), NIST SP 800‑61r3, MITRE ATT&CK;, and D3FEND.

Set roadmap and strategy for SOAR platforms (Splunk SOAR, Microsoft Sentinel SOAR/Logic Apps), case management, evidence collection, and response orchestration.

Define and oversee SOAR playbook automation builds, documentation, and execution

Define the AI augmentation incident response strategy for security operations: agentic AI workflows, LLM‑assisted triage, prompt libraries, notebook‑based investigation, and human‑in‑the‑loop autonomous response patterns.

Establish governance, guardrails, and auditability for AI‑assisted and AI‑autonomous response actions in support of regulatory frameworks and audits.

Define requirements and oversee build‑out of automation pipelines, playbooks, response actions, enrichment services, promptbook‑based investigation notebooks, and analyst‑facing tooling.

Establish and maintain centralized libraries of response tools, scripts, prompt books, notebooks, and live‑response packages deployable via EDR, SOAR, and endpoint management platforms.





Drive incident response tooling and integration strategy across EDR, XDR, SIEM, identity, cloud, network, ticketing, and AI platforms to enable closed‑loop response.

Partner closely with the detection product team to ensure detections produce response‑ready, automatable, and AI‑consumable outputs.

Define KPIs and OKRs for response product effectiveness: MTTR, automation coverage, AI‑assist coverage, analyst toil reduction, containment time, evidence completeness.

Manage vendor relationships, evaluations, POCs, and procurement for response and AI tooling.

Govern the RESPOND backlog, prioritize work for embedded product team members, and run agile delivery cadence.

Represent RESPOND capabilities to executive leadership, audit, and regulators.

All About You

Extensive in-depth heads‑on experience in security operations, incident response, digital forensics, automation engineering, or security engineering, with at least 3 years in a product, architecture, or capability ownership role.

Deep, hands‑on expertise with SOAR tools, including playbook development, integration into Agentic AI tools, integration into case management, custom app/connector creation, and platform administration.

Proven enterprise‑scale experience designing and operationalizing AI augmentation in security operations, including:

Agentic AI workflows for triage, enrichment, scoping, or response.

Prompt engineering and maintained prompt book libraries for analyst use.

Jupyter notebook‑driven investigation and DFIR workflows.

LLM integration into SOAR, case management, or analyst tooling.

Demonstrated track record shipping AI‑augmented incident response capabilities in a large e

📌 Threat Response Technology and Capabilities Product Owner (St Leonards)
🏢 Mastercard
📍 St Leonards