Security Operations Team Lead

This is a fully remote position, open to applicants in New York.

📋 Description

• Lead, mentor, and develop the Security Operations team.

• Establish priorities, manage the operational rhythm, and create career development paths.

• Oversee responses to significant incidents, make containment decisions, manage stakeholder communication, and handle after-action reviews.

• Take ownership of metrics and the roadmap for the agentic SOC.

• Supervise the fleet of security agents responsible for initial triage, investigation, and response.

• Define guidelines and human approval checkpoints, assess accuracy, maintain an audit trail, and report on the impact of autonomous handling and analyst capacity.

• Manage posture goals, remediation governance, product feedback loops, and reporting for the internal Cyera deployment.

• Establish detection and response priorities alongside the Security Engineering lead, guided by threat models and coverage.

• Design and implement on-call and coverage plans, including external or follow-the-sun support.

• Tackle the most challenging investigations, develop detections and playbooks, and write code utilizing AI-assisted workflows.

• Represent Security Operations to security leadership and R&D; convert operational data into risk assessments and status reports.

⛳️ Requirements

• A minimum of 5 years of experience in security operations, incident response, or detection engineering, including senior or lead roles.

• Proven experience managing significant incidents from start to finish, including communication with executives.

• Experience in leading, mentoring, or managing engineers or analysts.

• Practical experience in executing AI-assisted and agent-based security workflows, with a comprehensive understanding of agent reliability, failure points, and measurement.

• In-depth knowledge of AWS security architecture, IAM, logging, and cloud incident response.

• AWS Security Specialty or Solutions Architect Associate certification, or equivalent demonstrated expertise.

• Proficient in Python and detection engineering within SIEM and cloud telemetry; capable of reviewing and enhancing others' work.

• Experience in defining metrics, managing operational rhythms, and reporting to leadership.

• Strong communication skills with both executives and engineers; able to remain calm and decisive under pressure.

• Familiarity with DSPM, DLP, or operating a security product as an internal customer.

• Experience in regulated environments such as FedRAMP, SOC 2, or ISO 27001.

• GCIH, GCFA, CISSP, AWS Security Specialty, or similar certifications are advantageous.

🏝️ Benefits

• Unlimited PTO.

• Paid holidays and sick leave.

• Health, vision, and dental insurance.

• Life insurance, along with short and long-term disability coverage.

• Standard benefits and equity package.

• Potential for merit-based increases depending on individual or company performance, tenure, and other discretionary factors.