Director of Security Operations – Detection Engineering
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Security operations director owning SOC detection, response, and AI automation for RFA, a cybersecurity partner to financial-services firms. Leading analysts across client environments.
Responsibilities:
- Own the architecture of RFA's security operations stack, including SIEM, EDR, identity and email security
- Decide what security technologies to build, buy, consolidate, or retire
- Build a repeatable onboarding playbook for new clients and acquired MSPs
- Standardize log sources, integrations, and baseline detections across client environments
- Write and tune detections for threats including impossible travel, MFA fatigue, token replay, malicious mailbox rules, and business email compromise
- Design triage and response automation with Titan's engineers and convert playbooks into AI-agent workflows with guardrails
- Lead, hire, and develop RFA's SOC team
- Run serious incidents hands-on through alerting, containment, evidence preservation, and client debrief
- Identify and close security coverage gaps across RFA and client environments
- Report SOC performance to the CISO and client leadership in business reviews
- Work closely with Titan's engineering team on agents and automation
- Own RFA's detection and response capability end to end, including 24/7 analyst operations
Requirements:
- 8+ years in security operations, including hands-on experience as a security engineer, detection engineer, or incident responder
- 2+ years leading a SOC or security engineering team
- Experience building or running security operations at an MSSP, MDR provider, or MSP across multiple client environments
- Experience deploying and tuning a SIEM and EDR platform
- Deep knowledge of Microsoft 365, Entra ID, and Defender
- Comfortable writing Python and KQL/SPL or similar queries
- Experience with APIs and SOAR tooling
- Ability to determine appropriate human oversight for AI-agent triage
- Ability to explain incidents to fund COOs in plain language
- Experience with financial services clients and regulatory needs such as SEC, FINRA, Reg S-P, or UK FCA is a bonus
- Detection-as-code, threat hunting, or digital forensics experience is a bonus
- GCIH, GCIA, GCFA, OSCP, or similar certification is a bonus
- Experience integrating acquired companies' security stacks is a bonus
Benefits:
- Remote work arrangement in the US
- Travel under 5% for occasional client meetings and time with the team in NYC
Similar Jobs
Security Operations Specialist
Security Operations Specialist protecting AllCloud’s AWS cloud environment, endpoints, and corporate systems. Managing detection, incident response, vulnerabilities, and SOC 2/ISO 27001 compliance.
Associate SOC Analyst
Associate SOC Analyst investigating threats across endpoint and cloud environments. Supporting Expel’s managed detection and response service through alert triage and incident response.
Lead Data Security Operations Engineer
Lead data security engineer operating JLL’s enterprise security tooling. Supporting DLP, CASB/SASE, and endpoint security for a global real estate services company.
Endpoint Security Operations Engineer – Microsoft Defender
Endpoint Security Operations Engineer operating Microsoft Defender for Gruve’s enterprise cybersecurity services. Investigating threats, remediating incidents, and maintaining endpoint compliance across global 24x7 operations.
Security Operations Analyst L1 – MS Defender
Security Operations Analyst monitoring Microsoft Defender alerts and endpoint protection for Gruve, an AI-focused software services startup. Performing L1 triage, incident logging, escalation, and 24x7 security operations support.
Soc Analyst
SOC Analyst investigating security alerts, malware, and incidents for Cynet’s AI-powered threat detection platform. Performing threat hunting, digital forensics, and incident response for global customers.
Soc Analyst
SOC Analyst investigating alerts, malware, and live incidents for Cynet’s AI-powered threat detection platform. Performing threat hunting, digital forensics, and malware analysis for global customers.
Soc Analyst
SOC Analyst investigating security alerts, malware, and incidents for Cynet’s AI-powered threat detection platform. Performing digital forensics and threat hunting for global customers.
Manager, Security Operations Center
Security Operations Center Manager leading Workstreet’s 24x7 client monitoring, detection, and incident escalation operations. Managing analysts, SLAs, security tooling, and compliance-focused service delivery.
Cloud Architect – Operations, Security Governance
Arquitecto Cloud senior diseñando modelos operativos y de madurez de seguridad para Landing Zones AWS. Definiendo estándares, controles y roadmaps para entornos empresariales bancarios.
Senior Manager, Security Incident Response
Senior security leader directing global investigations and incident response for Affirm’s transparent fintech payment platform. Building scalable response, AI-enabled workflows, and executive risk reporting.
Senior Manager, Security Incident Response
Senior security leader directing Affirm’s global incident response and investigations. Building scalable detection, readiness, and AI-enabled security capabilities for fintech payments.
SOC Analyst
SOC Analyst monitoring Consensys’s blockchain infrastructure, enterprise systems, and Web3 protocols. Detecting threats, responding to incidents, and securing Linea and Lineth ZK-rollup ecosystems.
Senior Manager, A&D Security Operations
Senior Manager leading acquisition and divestiture cybersecurity operations for Johnson & Johnson’s global healthcare businesses. Managing transaction portfolios, risk governance, post-close coordination, and operational maturity.
Senior Manager, A&D Security Operations
Senior Manager leading cybersecurity operations for Johnson & Johnson acquisitions and divestitures. Managing transaction portfolios, risk governance, integrations, and executive reporting.
Cloud Architect – Operations, Security Governance
Cloud Architect definiendo modelos operativos, madurez de seguridad y roadmaps para Landing Zones AWS empresariales en Keppri. Impulsando gobierno, resiliencia, automatización y estandarización cloud.
Director, Global Security Operations Center
Director leading Twilio’s 24/7/365 global security operations center. Protecting Twilio’s communications technology, people, assets, and operations through intelligence-driven physical security.
Security Operations Analyst L2 – SOC
Security Operations Analyst monitoring alerts, investigating incidents, and maintaining compliance for Supply Chimp’s US government supply and logistics operations. Improving security tools, documentation, and controls remotely from Colombia.
Network Operations Security Engineer
Network Operations Security Engineer securing AXON Networks’ AI-driven ISP orchestration platform, routers, cloud, and Kubernetes services. Coordinating vulnerability remediation, incident readiness, and production security across North America.
Security Operations Team Lead
Security Operations Team Lead leading incident response, agentic SOC operations, and security engineering at Cyera. Securing enterprise AI adoption through internal customer-zero operations.