Director, Security Operations

This is a fully remote position, open to applicants in United States.

📋 Description

• Report directly to the Chief Information Security Officer (CISO)

• Establish the technical direction for the security operations team and serve as the CISO’s trusted deputy for technical security and operations

• Oversee the strategic direction of technical security operations, controls, and processes

• Lead security due diligence and post-merger integration assessments for acquisitions

• Develop and maintain a standardized M&A integration playbook, which includes an assessment checklist, risk scoring, remediation plan, and day-one controls

• Craft risk narratives and recommendations for the CISO and deal teams

• Direct the penetration testing cycle, encompassing scoping, triage, remediation tracking, and leadership reporting

• Manage SOC coordination across Accelerant and Mission US/UK, ensuring alignment on shared priorities, escalation paths, handoffs, and coverage gaps

• Own the strategy for the detection platform, including cost and ingestion management for Microsoft Sentinel

• Act as the incident response manager for technical incidents from triage to resolution

• Maintain and update technical incident response playbooks

• Facilitate post-incident lessons-learned reviews and monitor control changes until completion

• Conduct control reviews and suggest improvements

• Serve as the internal escalation point for the external SOC

• Build and lead the security engineering team, which includes hiring, line management, work assignments, output reviews, and coaching

• Manage security tooling and service vendors, overseeing selection, renewals, performance, and escalations

• Engage in hands-on engineering and investigative work as required

⛳️ Requirements

• 6 to 9 years of experience in security engineering

• Broad expertise in cloud security, network security, and detection engineering, with specialized knowledge in Azure and Microsoft Sentinel

• Experience leading incident responses for technical incidents, including conducting post-incident reviews

• Familiarity with assessing the security of acquisitions

• Understanding of modern identity and authentication mechanisms, such as passkeys and privileged access

• Proven experience in hiring, line-managing, and developing security engineers

• Ability to articulate a clear risk narrative and present it to leadership

• Sound judgment in ambiguous situations and effective prioritization amidst competing demands

• Experience managing relationships with security vendors

• Willingness to remain engaged with technical work; this position is not solely managerial

• Preferred: experience in assessing acquisition targets or integrating acquired companies, including the creation of repeatable playbooks

• Preferred: experience in running a recurring penetration testing or automated pentest program and driving remediation efforts

• Preferred: experience coordinating a SOC or managed detection service across multiple entities or regions

• Preferred: experience with Microsoft Sentinel and optimizing SIEM costs

• Preferred: experience securing AWS environments and collaborating with Cloudflare

• Preferred: experience implementing phishing-resistant authentication methods like passkeys or FIDO2

• Preferred: certifications such as CISSP, CISM, GIAC, AZ-500, or SC-200

• Preferred: experience in insurance, financial services, or another regulated industry

🏝️ Benefits

• Competitive salary and performance-based bonuses

• Comprehensive health, dental, and vision insurance

• Retirement savings plan with company matching

• Generous paid time off and flexible working arrangements

• Opportunities for professional development and career advancement