[Hiring] Director of Security Operations @National Debt Relief

Role Description

The Director of Security Operations leads the team responsible for detection and response across the enterprise. This role owns incident response, endpoint detection and response, email security, and SIEM and detection engineering, along with the monitoring and automation that support them. The director sets the strategy, staffing model, budget, and operating metrics for the function, and remains a working leader who takes incident commander duty, builds detections, and reviews analyst work alongside the team.

Responsibilities

• Own the detection and response strategy and multi-year roadmap, and align it to enterprise risk, the threat landscape, and business priorities.
• Lead, coach, and develop the security operations team, including hiring, scheduling, on-call rotation, performance management, succession planning, and career development.
• Operate as a player coach, taking incident commander duty, writing detections, and performing hands-on analysis alongside the team.
• Own the incident response program end to end, including the IR plan, severity model, escalation paths, tabletop exercises, evidence handling, and post-incident review.
• Own endpoint detection and response strategy and operations, including policy tuning, coverage assurance, containment workflows, and threat hunting.
• Own email security, including phishing defense, mail authentication controls (SPF, DKIM, DMARC), user reporting workflows, and response to business email compromise attempts.
• Own SIEM and detection engineering, including log source onboarding, detection development and testing, alert quality, and false positive reduction.
• Build and maintain automation and runbooks that shorten response time and remove repetitive analyst work.
• Develop threat-informed detection coverage mapped to MITRE ATT&CK and validate it through purple team and control testing.
• Define and report operational metrics including mean time to detect, mean time to respond, alert volume and quality, coverage, and containment effectiveness.
• Coordinate with IT, engineering, legal, privacy, and communications during incidents, including support for regulatory and customer notification decisions.
• Own budget, staffing plan, and vendor strategy for the detection and response stack, including managed service providers, tooling selection, and licensing.
• Present program status, incident outcomes, and risk decisions to executive leadership, and support board, audit committee, and regulator reporting as requested.
• Support audit and compliance requirements with evidence for monitoring, response, and control operation.

Qualifications

• 10 years of information security experience, including 5 years focused on security operations, incident response, or detection engineering, required.
• 5 years of direct people leadership experience, including hiring, performance management, and on-call ownership, required.
• Experience owning a function level budget, vendor relationships, and a staffing plan, required.
• Bachelor’s degree in information systems, computer science, or a related field, or equivalent practical experience.
• Industry recognized certification(s) highly recommended: GCIH, GCIA, GCFA, CISSP, or CISM.

Required Skills/Abilities

• Hands-on operational experience with SIEM platforms, including query authoring, data modeling, and detection development.
• Hands-on experience with EDR platforms, including policy design, containment actions, and threat hunting.
• Experience operating email security controls and phishing response at scale.
• Working knowledge of attacker tradecraft including initial access, persistence, privilege escalation, lateral movement, and exfiltration.
• Practical use of MITRE ATT&CK for coverage assessment and detection planning.
• Incident response and forensic practice, including host and cloud artifact analysis, chain of custody, and timeline construction.
• Cloud detection and response experience in AWS, Azure, or GCP, including identity provider telemetry such as Okta or Entra ID.
• Scripting and automation ability (Python, PowerShell, or similar) for enrichment, response actions, and SOAR workflows.
• Strong knowledge of TCP/IP, DNS, HTTP, and operating system internals for Windows and macOS.
• Knowledge of secure configuration management and endpoint security technologies across multiple platforms.
• Understanding of compliance areas including controls for SOC 2, PCI DSS, and applicable state privacy and breach notification requirements.
• Ability to remain calm and decisive during active incidents and to communicate status clearly to technical and executive audiences.
• Strong verbal and written communication, including the ability to translate technical risk into business terms for non-technical stakeholders.
• Proven ability to build rapport and durable working relationships with business, IT, and engineering leaders.
• Ability to influence without direct authority and to position security as a pragmatic, value-added partner rather than a control function.
• Strong documentation and communication skills.
• Curious, inquisitive, innovative, lifelong learner and self-starter.
• Able to effectively give, receive, and respond to feedback.

Benefits

• Generous Medical, Dental, and Vision Benefits.
• 401(k) with Company Match.
• Paid Holidays, Volunteer Time Off, Sick Days, and Vacation.
• 12 weeks Paid Parental Leave.
• Pre-tax Transit Benefits.
• No-Cost Life Insurance Benefits.
• Voluntary Benefits Options.
• ASPCA Pet Health Insurance Discount.
• Wellness Incentive Program.