Security & Threat Operations Manager

What You’ll Do

Program Maturity & Team Leadership

• Program Development: Mature Security & Threat Operations through a measurable roadmap, defined operating model, appropriate monitoring coverage, escalation procedures, and service provider oversight.
• Team Development: Grow and lead the team through hiring, coaching, training, career development, and performance management.

Threat Detection, Investigation & Intelligence

• Detection Engineering: Own the detection program incorporating threat intelligence, content development, proactive hunting, and validation through attack simulations and purple-team exercises. Treat detection content development as an engineering discipline.
• Monitoring & Investigation: Own security monitoring and investigation across product and corporate environments, including phishing, malware, credential compromise, API abuse, DDoS, and insider threats.
• Digital Risk Monitoring: Own digital risk monitoring covering external attack surfaces, leaked credentials, exposed data, impersonation, phishing domains, and takedown coordination.

Incident Response

• Automated Response: Partner with Security Engineering to build pre-defined automated security response actions. Coordinate with business leaders on required response actions which cannot be automated or which require compensating actions to prevent unnecessary business disruption.
• Incident Management: Own the incident response lifecycle as Incident Commander, including preparedness, forensic evidence handling, containment, recovery validation, regulatory coordination, and post-incident improvement.

Exposure Management & Control Operations

• Exposure Management: Own the exposure management lifecycle from discovery through verified closure, coordinating remediation with accountable system and product owners.
• Control Operations: Own the operation and tuning of operational security controls, such as DLP, WAF, email filtering, and identity compromise prevention in partnership with Security Engineering, DevOps & Platform, and Product & Engineering to meet evolving product and corporate technology requirements.

Compliance & Assurance

• Regulatory Controls: Partner with Legal, Compliance, Security Engineering, and GRC to implement SEC and FINRA requirements, including SEC Rule 17a-3 and 17a-4 controls supporting record capture, preservation, integrity, access, and retrieval.
• Control Assurance: Partner with Security Engineering to automate control validation and evidence collection. Support audits and regulatory examinations, and drive remediation of technical findings.

You Bring

• 10+ years in security operations, detection engineering, incident response, or related disciplines, including 3+ years managing technical teams and experience building or maturing an operations function.
• Demonstrated experience serving as Incident Commander during significant security incidents, making decisions under pressure, coordinating multiple teams, and communicating clearly with executives and business stakeholders.
• Strong hands-on expertise in threat intelligence, detection content development, SIEM and endpoint analytics, investigation, threat hunting, and defensive validation.
• Practical scripting or query skills in Python, SQL, or comparable languages.
• Working knowledge of AWS, Kubernetes, API security, identity, and Windows/macOS endpoint telemetry. Experience supporting production environments with demanding availability and latency requirements is preferred.
• Experience creating, operating, and tuning preventive controls such as DLP, WAF, and email filtering while managing false positives and business impact.
• Experience investigating insider threats and digital risks such as exposed credentials, impersonation, and phishing domains, with appropriate handling of sensitive information and coordination with HR and Legal.
• Strong people leadership, process design, and prioritization skills, with the ability to influence Engineering and IT, manage competing operational demands, and support on-call escalation and incident response outside normal business hours.
• Familiarity with NIST CSF, incident response practices, and MITRE ATT&CK. Experience in regulated financial services, including SEC/FINRA environments and applicable incident, data protection, and recordkeeping obligations, is preferred.
• Bachelor’s degree in a related field or equivalent practical experience. Relevant certifications such as CISSP, GCIH, GCIA, or GCFA are a plus.