Security Operations & Engineering Manager

The Security Operations & Engineering Manager leads both the operational defense of the organization (monitoring, detection, incident response) and the engineering of the security infrastructure that powers it (tooling, automation, detection logic, integrations). This is a hybrid leadership role for someone equally comfortable managing a team through a live incident and architecting the systems that prevent the next one.

Key Responsibilities

Operations

• Build and lead 24/7 (or business-hours, depending on org) security monitoring, detection, and incident response functions.
• Architect and own the incident response lifecycle: detection, triage, containment, eradication, recovery, and post-incident review/root cause analysis.
• Oversee vulnerability management program — scanning, prioritization, and remediation tracking with asset owners.
• Deliver regular metrics, dashboards, and executive reporting on security posture, MTTR/MTTD, and incident trends.
• Contribute to capacity management and budget management

Engineering

• Design, build, and maintain security infrastructure: SIEM, SOAR, EDR, IDS/IPS, infrastructure hardening and log pipelines.
• Develop and tune detection engineering — writing and refining correlation rules, alerts, and automated response playbooks.
• Automate repetitive SOC workflows (triage, enrichment, ticketing) to reduce analyst toil and alert fatigue.
• Partner with software/platform engineering on secure architecture reviews, threat modeling, and shift-left security practices.
• Evaluate, pilot, and implement new security technologies; manage tool lifecycle and vendor relationships.

Leadership & Governance

• Hire, mentor, coach and manage a team of security analysts and security engineers.
• Collaborate cross-functionally with IT, legal, compliance, and engineering leadership on audits, investigations, and security initiatives.
• Manage relationships with MSSPs, security vendors and business partners