Leading the people, processes, and operational disciplines that support managed cybersecurity services is the core of this senior leadership role. The Director of Security Operations will be accountable for effective security monitoring, threat detection, investigation, incident response, and continuous improvement across customer and enterprise environments. This role combines security operations strategy, people leadership, customer engagement, and hands-on oversight.
Responsibilities
Lead, develop, and mentor a high-performing team of SOC analysts, detection engineers, red team operators, cyber threat intelligence analysts, and exposure management analysts
Define the security operations strategy, operating standards, service model, and capability roadmap
Oversee day-to-day monitoring, alert triage, investigation, escalation, and response activities across customer and enterprise environments
Serve as the senior operational leader during major security incidents, coordinating investigation, containment, recovery, and executive and customer communications
Lead the detection engineering program, including detection development, validation, tuning, coverage assessment, and lifecycle management
Integrate cyber threat intelligence and threat hunting into SOC operations to improve detection, investigative context, and proactive defense
Establish clear standards for alert analysis, case documentation, escalation quality, quality assurance, and operational reporting
Identify and implement practical applications of AI across security operations to accelerate triage and investigation, improve analytical quality, automate repeatable workflows, and enhance service scalability while maintaining appropriate human oversight
Develop and maintain operating procedures, investigation playbooks, escalation criteria, and incident response processes
Work directly with customers and enterprise stakeholders to understand priorities, communicate risk, explain operational decisions, and resolve service concerns
Partner with Security Engineering and IT teams to ensure security platforms, telemetry, integrations, and automation reliably support SOC requirements
Manage operational priorities, staffing, hiring, performance, professional development, on-call coverage, and service delivery risk
Support solution development, operational proposals, service transitions, and strategic customer engagements
Requirements
15+ years of experience in cybersecurity, security operations, incident response, detection engineering, threat intelligence, or a related discipline
5+ years of experience leading cybersecurity or security operations teams. Preference will be given to applicants who have led large SOC, MDR, or multi-customer security operations teams at the Director level or above
Millions of jobs, with real people getting hired every day
200,000+
New jobs added daily
7,000,000+
Verified job listings
1,000,000+
Tailored applications submitted
Deep understanding of SOC operations, including monitoring, alert triage, investigation, escalation, incident response, threat hunting, and continuous improvement
Demonstrated experience leading complex security incidents and coordinating technical, business, customer, and executive stakeholders through response and recovery
Strong knowledge of detection engineering practices, including use-case development, detection validation, tuning, coverage analysis, and MITRE ATT&CK mapping
Experience integrating cyber threat intelligence and adversary tradecraft into detection, hunting, investigation, and response activities
Strong operational understanding of SIEM, EDR/XDR, identity, network, cloud, email, and other security telemetry used for detection and investigation
Experience defining and using security operations metrics to manage workload, service quality, detection effectiveness, response performance, and operational risk
Proven ability to build, mentor, and lead high-performing security operations teams in demanding environments
Strong ability to translate business, threat, and risk priorities into security operations priorities and execution plans
Strong communication and customer-facing skills, with the ability to explain incidents, operational performance, and technical risk to analysts, technical leaders, executives, and customers
Sound operational judgment, including the ability to make timely decisions under pressure, manage competing priorities, and balance risk, evidence, customer impact, and service commitments
Nice to have:
Experience leading security operations within a managed security services, managed detection and response, enterprise SOC, or other multi-customer service environment
Demonstrated success building, modernizing, or maturing a SOC while maintaining service continuity and operational performance
Demonstrated understanding of how AI can be applied to security operations, including alert triage, investigation support, analytical quality assurance, knowledge management, reporting, and workflow acceleration
Experience using SOAR platforms and operational automation to improve consistency, speed, and analyst effectiveness
Experience operating security monitoring and incident response capabilities across public cloud and hybrid enterprise environments
Experience establishing quality assurance, case review, and continuous improvement programs for security operations
Experience managing service-level commitments, operational risk, and customer expectations in a managed services environment
Experience managing relationships with security technology vendors, intelligence providers, and operational partners
Demonstrated ability to lead teams successfully through organizational, process, or operational change
CISSP, GCIH, GCIA, or comparable advanced cybersecurity certification preferred
About the Company
At Everforth ECS, we solve complex cybersecurity and technology challenges for commercial, government, defense, and intelligence customers.
