Cyber Defense Unit Manager

This is a fully remote position, open to applicants in Florida, +2 more states.

📋 Description

• Lead the Cyber Defense division, focusing on strategy, roadmap, operational models, and ongoing improvement in maturity.

• Oversee, mentor, and cultivate a global team of analysts, responders, threat hunters, and detection engineers.

• Ensure comprehensive security coverage across various time zones, utilizing follow-the-sun or on-call models.

• Determine the build-versus-buy strategy and manage partnerships with MDR/MSSP and other external collaborators.

• Administer the Cyber Defense budget effectively.

• Supervise continuous 24x7 security monitoring, alert triage, investigations, and escalations across endpoints, networks, identities, applications, and cloud environments.

• Establish and uphold SOC processes, runbooks, severity definitions, and handoff procedures.

• Spearhead proactive threat hunting initiatives and monitor attack surfaces.

• Oversee the detection engineering lifecycle, which includes use case development, testing, tuning, deployment, and retirement.

• Align detection coverage with MITRE ATT&CK and prioritize enhancements.

• Define log source requirements and onboarding priorities in collaboration with IT, Cloud, and Engineering teams.

• Conduct purple team and adversary emulation exercises.

• Lead the response to significant cybersecurity incidents involving Security, IT, Engineering, Legal, Communications, and executive leadership.

• Maintain and test incident response plans, playbooks, and crisis communication protocols.

• Oversee digital forensics, evidence handling, containment, eradication, and recovery processes.

• Assist with breach assessments and decisions regarding regulatory notifications.

• Conduct post-incident reviews and ensure corrective actions are completed.

• Build and oversee threat intelligence capabilities.

• Transform intelligence into actionable detections, hunts, blocking measures, and risk-informed recommendations.

• Engage in industry intelligence-sharing communities and partnerships.

• Manage and enhance SIEM, EDR/XDR, SOAR, and threat intelligence platforms.

• Propel automation and AI-assisted capabilities for detection, enrichment, triage, investigation, and response.

• Utilize Acronis products and platform capabilities to bolster internal defenses.

• Establish KPIs and reporting mechanisms for evaluating cyber defense effectiveness.

• Report on the cyber defense posture, significant incidents, and risk trends to senior leadership, the Board, and the Audit Committee as necessary.

• Collaborate with Security, IT, Cloud, Engineering, Product Security, and Legal teams.

• Coordinate with Vulnerability Management and Product Security on exploitable risks, emergency patching, and threat-informed prioritization.

• Assist with audits, customer assurance requests, and compliance with regulatory requirements.

⛳️ Requirements

• Extensive cybersecurity experience (typically 10+ years) in security operations, incident response, threat detection, or cyber defense, with at least 5 years in leadership roles.

• Proven track record of leading cybersecurity teams within a global technology or software context, including managing distributed, multi-time-zone teams.

• Demonstrated capability in leading major incident response efforts from detection through recovery and post-incident analysis.

• Strong grasp of modern attacker methodologies, threat actor tradecraft, and frameworks such as MITRE ATT&CK.

• Practical knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, and security monitoring technologies, including their evaluation and optimization.

• Experience in threat hunting and detection engineering, particularly with detection-as-code methodologies.

• Solid understanding of AWS, Azure, or other contemporary cloud environments, including cloud-native logging, detection, and response mechanisms.

• Familiarity with digital forensics and investigations, along with a working knowledge of breach notification and regulatory obligations.

• Experience in leveraging automation, scripting (e.g., Python), and ideally AI within security operations.

• Background in managing budgets, vendors, and managed security service providers.

• Strong leadership, analytical, and decision-making capabilities, especially in high-pressure situations.

• Ability to articulate complex cybersecurity risks clearly to both technical and executive audiences, including legal and board members.

• High integrity and sound judgment in handling sensitive, confidential, and privileged information.

• Relevant certifications such as CISSP, CISM, GIAC (GCIH, GCFA, GCTI, GCDA), or OSCP are advantageous.

• A comprehensive criminal, educational, and identification background check is mandatory for all new hires.

🏝️ Benefits

• Medical coverage

• Dental coverage

• Vision coverage

• Flexible spending accounts (FSA)

• Disability insurance

• Life insurance

• 401(k) retirement plan with company match

• Generous vacation policy