Security Operations Team Lead
Posted Updated
Description
- Join our team as the Security Operations Team Lead. You will lead a team of Security Operations Engineers, serve as incident commander for major incidents, and own the day-to-day health and improvement of our agentic SOC
- You will also run our customer zero program, in which we operate the Cyera platform on our own environment and feed what we learn back to Product. This is a player-coach role: you lead the team and stay hands-on
- The ideal candidate has 5 or more years in security operations or incident response, including senior or lead-level experience, has run significant incidents end to end, and has led or mentored engineers
- Team Leadership: Lead, coach, and develop the Security Operations team; set priorities, run the operational cadence, and build career paths
- Incident Command: Direct the response to major incidents, make containment calls, manage stakeholder communication, and own the after-action process
- SOC Operating Model: Own the metrics and roadmap for the agentic SOC and prioritize the improvements that move them
- Agentic Fleet Management: Own the fleet of security agents that handle first-pass triage, investigation, and response: define guardrails and human approval points, evaluate accuracy, keep an audit trail, and report impact on autonomous handling and analyst capacity
- Customer Zero Program: Own posture goals, remediation governance, the product feedback loop, and reporting for our internal Cyera deployment
- Detection and Response Strategy: Set detection and response priorities with the Security Engineering lead based on threat model and coverage
- Coverage: Design and run on-call and coverage arrangements, including any external or follow-the-sun support
- Hands-On Work: Take the hardest investigations, build detections and playbooks, and write code, with AI-assisted workflows as the default way of working
- Stakeholder Management: Represent Security Operations to security leadership and R&D; translate operational data into risk and status
- Technical Depth: Strong Python and detection engineering across SIEM and cloud telemetry; able to review and improve others’ work
- AI-Assisted Workflows: Hands-on experience running AI-assisted and agent-based security workflows, with a clear view of where agents are reliable, where they fail, and how to measure both
- AWS Certification: AWS Security Specialty or Solutions Architect Associate, or equivalent demonstrated depth
- Incident Command: Experience running significant incidents end to end, including executive communication
- Operating Discipline: Experience defining metrics, running an operational cadence, and reporting to leadership
- Experience: 5 or more years in security operations, incident response, or detection engineering, including senior or lead-level work
- AWS Knowledge: Strong knowledge of AWS security architecture, IAM, logging, and cloud incident response
- Communication: Clear with executives and engineers; calm and decisive under pressure
- Leadership: Experience leading, mentoring, or managing engineers or analysts
- Data Security: Experience with DSPM, DLP, or operating a security product as an internal customer
- Regulated Environments: FedRAMP, SOC 2, or ISO 27001
- Certifications: GCIH, GCFA, CISSP, AWS Security Specialty, or similar