Senior Manager, Security Operations

This is a founding leadership role responsible for building and scaling a modern Security Operations Center from the ground up. You will shape the SOC’s team, tooling, detection strategy, operating model, and 24/7 response capabilities rather than inheriting an established function. The role spans both production and cloud environments as well as corporate and enterprise systems, creating a unified approach to detection and response across complex technology estates. Reporting to the CISO, you will lead detection engineering, incident response, threat hunting, threat intelligence, security analytics, and endpoint and workload protection. A strong focus on AI, automation, and data-driven operations will enable a small, highly leveraged team to focus on complex security challenges rather than routine alert processing. You will also serve as a trusted incident leader and strategic security partner across engineering, compliance, and executive teams.

• 8+ years of experience in security operations, incident response, detection engineering, threat intelligence, or a closely related field, including 3+ years leading teams.
• Demonstrated hands-on security expertise, including personally writing detections, conducting investigations, leading incidents, and building security automation.
• Experience building or substantially rebuilding a SOC function rather than exclusively operating within an established organization.
• Strong experience across both production/cloud security monitoring and corporate/enterprise security operations.
• Deep knowledge of modern security operations technologies, including SIEM and security data platforms, EDR, SOAR or equivalent automation, and cloud-native telemetry.
• Strong detection engineering capabilities with the ability to develop and improve detection content directly.
• Experience with cloud and container security monitoring; AWS and Kubernetes experience is strongly preferred.
• Understanding of identity-focused attack paths involving SSO, OAuth, session compromise, MFA bypass, and privilege escalation across SaaS and cloud environments.
• Proven incident command experience during significant security events, including executive communication and appropriate escalation judgment.
• Demonstrated use of AI in security operations, such as triage, enrichment, detection creation, investigation support, or reporting, with the ability to explain measurable outcomes.
• Experience designing 24/7 security coverage and managing globally distributed teams across multiple time zones.
• Experience in transportation, logistics, IoT, connected devices, or critical infrastructure is a plus.
• Strong communication, prioritization, decision-making, and problem-solving skills, with the ability to remain effective during high-pressure security incidents.
• Must be authorized to work in the United States and authorized to receive and access commodities and technologies controlled under U.S. Export Administration Regulations.