Security Engineering Manager

Our Information Security team is seeking an experienced, hands-on Security Engineering Manager to lead the health, performance, and continuous improvement of our security tooling ecosystem and own the maturity of our Incident Response program.

• →

  Lead the healthy functioning of the security stack across endpoints, including EDR, DLP, ZTNA, PAM, and EPM, and drive continuous policy improvements across each.

• →

  Further mature and track health metrics for each tool (agent coverage, policy drift, false-positive rates) and report on them to leadership.

• →

  Own the roadmap, as Service Owner, for tooling upgrades, migrations, and consolidation, coordinating with vendors and internal stakeholders.

• →

  Continue to mature and maintain playbooks, security architecture documentation, and standard operating procedures for the tooling under your ownership as Service Owner.

• →

  Evaluate emerging tooling capabilities and threats, and recommend changes to strategy and standards accordingly.

• →

  Administer and maintain ZTNA, DLP, EDR, and PAM policies, ensuring new policies are developed, tested, and rolled out without impact to end users or the business.

• Own the relationship with and performance management of Varicent's MDR vendor.

• Oversee vendor performance on Tier 1 and Tier 2 alert triage and deep investigation, holding the vendor accountable for quality, timeliness, and depth of analysis.

• Review vendor SLAs, escalation quality, and detection coverage on an ongoing basis; drive corrective action plans where performance gaps are identified.

• Coordinate Tier 3 remediation activities across Varicent, partnering with IT, Engineering, and Cloud Operations to ensure timely closure.

• Serve as the primary internal escalation point for significant or ambiguous alerts requiring cross-functional coordination.

• Own Incident Response processes, procedures, and playbooks end to end, ensuring they reflect current threats, tooling, and organizational structure.

• Draft, lead, and execute required tabletop exercises annually, including scenario design, facilitation, and after-action reporting.

• Drive continuous improvement of Incident Response readiness based on tabletop outcomes, real incidents, and industry lessons learned.

• Act as a senior escalation point or incident lead during significant security events, coordinating cross-functional response.

• Coordinate day-to-day security activities with IT analysts, external vendors, managed service providers, and contractors supporting endpoint security operations and incident response.

• Provide technical guidance and oversight to external service providers, ensuring alignment with security requirements, operational priorities, and service expectations.

• Influence peers and cross-functional partners across IT, Engineering, Cloud Operations, Legal, and Communications to align on security priorities and incident response commitments.

• Share technical expertise and best practices with security engineers and cross-functional stakeholders without direct people-management responsibilities.

• Communicate tooling health, vendor performance, and incident readiness to leadership through clear, risk-based reporting.

• Frame ambiguous, cross-functional problems related to endpoint security and incident readiness, and propose approaches rather than waiting for direction.

• Continuously identify opportunities to mature processes, strengthen controls, and improve security outcomes across teams by coordinating engagements with offensive security engineers.

• Stay current on the evolving threat landscape and detection/response best practices; share relevant learnings with the broader team.

• Bachelor's degree in Computer Science, Information Security, Information Technology, or equivalent experience.

• Minimum of 8 years of related experience in Security Engineering, Security Operations, or Incident Response; or 6 years with a Master's degree; or an equivalent combination of education and experience.

• At least one relevant information security certification (e.g., CISSP, CCSP, CISA, GCIH, GCIA, or equivalent).

• Hands-on experience administering and improving endpoint security tools such as EDR, DLP, ZTNA, PAM, and EPM platforms, following the ITIL framework as a Service Owner delivering continuous service improvements.

• Experience installing security agents and supporting IT teams with deployments through Intune, JAMF, and MDM.

• Demonstrated experience managing or overseeing third-party security vendors (e.g., MDR, MSSP) and holding them accountable to defined SLAs.

• Experience owning or significantly contributing to an organization's Incident Response program, including playbooks, procedures, and tabletop exercises.

• Strong understanding of security standards and frameworks (e.g., NIST CSF, NIST 800-61, ISO 27001/27002).

• Excellent written and verbal communication skills, with the ability to translate technical risk into business terms for leadership.

• Proven ability to operate with significant autonomy on complex, ambiguous problems and coordinate work across internal teams and external service providers.

• English proficiency is required.

• Experience providing technical leadership or coordinating security operations across internal teams, external vendors, or managed service providers without direct people-management responsibilities.

• Experience with security automation and orchestration (SOAR) to streamline alert triage and remediation workflows. Experience using AI for automation is a plus.

• Familiarity with regulatory and compliance frameworks relevant to Varicent's business (e.g., SOC 2, PCI, HIPAA).

• Experience building or maturing an endpoint security program with a service management mindset.

• Background in cloud security across major platforms (e.g., AWS, Azure Entra, and MDM).

• Develop a full understanding of the current security tooling stack, MDR vendor relationship, and existing Incident Response playbooks.

• Establish baseline health metrics and SLAs for each tool and the MDR vendor.

• Identify immediate gaps in tooling coverage, policy configuration, or vendor performance.

• Drive at least one significant tooling improvement or policy hardening initiative to completion.

• Implement a formal vendor performance review cadence with the MDR provider, with clear corrective actions where needed.

• Design and lead Varicent's annual tabletop exercise, including scenario development and after-action reporting.

• Refine Incident Response playbooks and procedures based on findings from the tabletop exercise and any real incidents.

• Demonstrate measurable improvement in tooling health metrics, vendor SLA performance, and incident response readiness.

• Establish a security tooling roadmap that anticipates emerging threats and business needs.

• Become the primary technical point of contact for endpoint security tooling strategy, vendor performance, and incident response across Varicent.

This posting is for a new vacancy.

This hiring process utilizes artificial intelligence tools to assist in candidate screening and assessment. Our AI tools are designed to complement — not replace — human decision-making.