Principal Operations Program Manager, Global SOC

Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at the highest level, and it deepens our need for good people who want to make a meaningful impact.

Founded in 2015 by former NSA cyber operators, Huntress is a remote-first team working to make enterprise-grade cybersecurity accessible to businesses of all sizes. We work closely with security teams and service providers protecting complex environments, often without the time or headcount to handle it all. That’s why we build our technology in-house and back it with a 24/7 human-led Security Operations Center (SOC). As a result, our platform is never disconnected from the experts who manage it, ensuring our customers' protection.

Huntress now secures more than 5M endpoints and 11M identities worldwide. Those numbers keep growing because more businesses rely on us to help carry the load and operate with more confidence. Every day, you can see that commitment in how we stand with our customers and how we show up for each other.

The Principal Operations Program Manager is the operational backbone of Huntress's Security Operations Center. You will translate analyst workflow realities into structural improvements, partnering closely with SOC leadership to transform how investigations move through the team. You will reduce friction, enforce consistency, and build the reporting infrastructure that turns detection signal into operational decisions. This role is about replacing tribal knowledge and reactive triage with a disciplined, continuously improving SOC operation that scales without sacrificing quality, managing multiple workstreams and stakeholders to get there.

• →Partner with SOC leadership to develop an authoritative understanding of analyst workflows, investigation patterns, and operational bottlenecks, then translate that understanding into a prioritized improvement agenda with clear milestones and owners
• →Own the identification, prioritization, and delivery of process and tooling improvements across SOC functions; maintain a structured backlog in close coordination with SO&E Engineering
• →Build and maintain reporting infrastructure that surfaces meaningful SOC performance signal including queue health, MTTD/MTTR trends, escalation patterns, and analyst utilization in service of decisions, not dashboards
• →Drive alignment with Support Operations on shared operational standards, coordinating cross-functional workstreams to ensure improvements scale across functions rather than solving in isolation
• →Own documentation quality within the SOC, holding the organization accountable to accuracy and usability standards that reflect a mature, auditable security operation
• →Translate operational findings into precise, executable requirements that move from analysis to engineering without back-and-forth
• →Lead the rollout of new tools, workflows, and training initiatives, owning adoption outcomes and surfacing friction before it becomes regression

• 5+ years in an operations, business operations, or process improvement role — ideally within a SOC, security, or technical support environment
• Demonstrated ability to analyze workflows and translate findings into structured, prioritized requirements
• Experience building or maintaining operational reporting and dashboards; comfortable working with data to tell a coherent story
• Familiarity with how SOC teams operate, including ticketing systems, alert queues, SLA tracking, and escalation workflows
• Proven track record of working cross-functionally with engineering or product teams to scope and deliver operational improvements
• Able to manage a backlog and communicate tradeoffs clearly without needing heavy oversight
• You use AI tools actively in your work today, not occasionally but as a default, and when you look at a workflow you're already asking which parts a well-designed system could handle; familiarity with where agentic workflows are heading in security operations is a strong plus