Manager, Threat Operations

This is a fully remote position, open to applicants in Australia.

📋 Description

• Oversee the development of MDR Team Leads and analysts by setting expectations, providing coaching, feedback, fostering career growth, and ensuring accountability.

• Cultivate leadership skills and succession planning within the operation.

• Manage MDR operational performance during APJ hours, including staffing, coverage, workload distribution, queue management, prioritization, and service-level commitments.

• Track operational health metrics such as demand, capacity, backlog, response times, investigation effort, quality, escalations, and operational risks.

• Coordinate a global 24x7 MDR service across various regions.

• Ensure seamless follow-the-sun operations through effective ownership, handovers, and escalation processes.

• Promote uniformity in triage and investigation methodologies.

• Uphold standards for investigation quality, case management, documentation, customer interactions, and operational procedures.

• Leverage operational data and metrics to inform staffing choices, enhance efficiency, improve quality, and achieve favorable customer outcomes.

• Serve as a senior escalation point for situations impacting customers, complex investigations, service risks, and workload challenges.

• Provide support during significant security incidents and high-severity customer situations.

• Maintain contingency strategies and ensure operational resilience.

• Foster operational readiness through skills coverage, onboarding, training, knowledge management, playbooks, processes, tooling, and leadership support.

• Spearhead readiness and change adoption for new detections, capabilities, tooling, automation, workflows, and processes.

• Minimize operational friction through standardization, automation, tooling, or process redesign.

• Collaborate with Threat Intelligence, Detection Engineering, Incident Response, Product, Engineering, and other teams.

• Champion continuous improvement by utilizing operational data, analyst feedback, customer escalations, quality assessments, and lessons learned.

• Maintain oversight of operational priorities, risks, performance metrics, improvement initiatives, and inter-team dependencies.

• Incorporate APJ perspectives into global MDR planning.

• Collaborate with MDR leadership on capacity planning, operational strategy, organizational priorities, and transformation initiatives.

⛳️ Requirements

• A minimum of 7 years of experience in cybersecurity operations, Managed Detection and Response, Security Operations Center operations, incident response, or a related field.

• At least 2 years of experience in leading teams, individuals, or operational functions.

• Experience in directing security operations within a high-volume, customer-focused environment.

• Demonstrated people-leadership capabilities, including coaching, performance management, career progression, recruitment, onboarding, and team enhancement.

• Proven experience in developing Team Leads, senior analysts, or frontline leaders.

• Familiarity with operating in a global or 24x7 security operations context.

• Deep understanding of security operations and the complete lifecycle of triage, investigation, escalation, response, and customer communication.

• Strong technical knowledge of endpoint, network, cloud, identity, and security telemetry.

• Experience in managing operational and customer escalations.

• Proven ability to utilize operational metrics and data to identify challenges and implement measurable improvements.

• Capability to enhance operational efficiency through process simplification, standardization, automation, or technology integration.

• Strong understanding of attacker tools, tactics, and techniques, including persistence, lateral movement, credential theft, ransomware, and defense evasion.

• Familiarity with the MITRE ATT&CK framework.

• Experience collaborating with Detection Engineering, Threat Intelligence, Incident Response, Product, Engineering, and customer-facing teams.

• Excellent judgment and decision-making abilities.

• Outstanding written and verbal communication skills.

• Relevant professional experience in cybersecurity, security operations, or related disciplines.

• Formal qualifications and certifications are valued but not mandatory if equivalent experience is evident.

• Preferred: experience leading MDR or security operations teams across Australia and/or APJ.

• Preferred: experience with automation, AI-assisted capabilities, process redesign, or operational transformation.

• Certifications such as CISSP, GCIH, CISM, or equivalent are advantageous but not essential.

🏝️ Benefits

• A remote-first working model, prioritizing remote work as the primary option for most employees.

• Employee-led diversity and inclusion networks.

• Annual charity and fundraising activities.

• Volunteer days.

• Global employee sustainability programs.

• Global fitness and trivia competitions.

• Global wellbeing days.

• Monthly wellbeing webinars and training sessions.

• Recruitment and selection adjustments to accommodate applicants with disabilities or other specific needs.