Countermeasures Team Lead

Role Description

Blackbaud is looking for a Team Lead to lead a dedicated Cyber Countermeasures function within the Cyber Operations organization. This role is responsible for building and maintaining proactive, adversary-focused defenses that detect, degrade, and disrupt threat actor activity before it impacts Blackbaud, its customers, and the data entrusted to us. The candidate will partner closely with Threat Intelligence, Red Team, Security Operations, and Incident Response, and will manage a team responsible for detection engineering and deception technology to build and tune detections that stop attacker activity. This is a critical role within the Cyber organization and will regularly interface with company leadership and technical teams.

What You'll Do

• Manage a team of countermeasures engineers and analysts, measure team performance, and create staff development opportunities as the function scales.
• Serve as the subject matter expert (SME) for cyber countermeasures, detection engineering, including network, email, and endpoint security.
• Develop and optimize detection engineering use cases, correlation rules, and behavioral analytics across SIEM, EDR, SOAR, and cloud platforms.
• Collaborate with Security Operations, Incident Response, and Vulnerability Management teams to ensure countermeasures are actionable, tested, and continuously improved.
• Represent the team in meetings with other teams and departments to drive projects and priorities toward completion.
• Act as a technical escalation point during major incidents where adversary countermeasures must be deployed in real time.
• Monitor industry research, emerging threats, and evolving attacker techniques to keep defenses ahead of adversary capabilities.
• Provide input to executive leadership on countermeasure effectiveness, defensive gaps, and future-state strategy.

Qualifications

• 7+ years of experience in cybersecurity, including significant experience in detection engineering, red/purple team operations, or cyber defense countermeasures.
• 3+ years of people management or team leadership experience.
• Hands-on experience with SIEM, EDR, SOAR, and deception technologies.
• Excellent communication skills (written and verbal) with the ability to translate complex technical topics for both technical teams and executive stakeholders.
• Preferred certifications: GIAC Cyber Threat Intelligence (GCTI), GIAC Reverse Engineering Malware (GREM), OSCP/OSEP, or CISSP.

Benefits

• Medical, dental, and vision insurance
• Remote-flexible workforce
• Wellness Programs
• 401(k) program with employer match
• Flexible paid time off
• Generous Parental Leave
• Donations for Doers
• Pet insurance, legal and identity protection
• Tuition reimbursement program