[Hiring] Director, Security Operations @Accelerant

Role Description

Accelerant is hiring a Director, Security Operations: a senior team lead who owns the work that calls for security judgment and will report directly to the Chief Information Security Officer (CISO). This is a senior, hands-on role: you set technical direction for the security operations team, stay close to the work, and act as the CISO’s trusted deputy for technical security and security operations, including changes in the threat landscape, vulnerabilities and incidents.

You are responsible for the strategic direction of our technical security operations, controls and processes. That includes:

• Assessing the security of mergers and acquisitions
• Owning the penetration test cycle
• Coordinating purple team exercises and SOC coordination
• Acting as the technical expert for projects

You’ll have the autonomy to drive technical initiatives from concept to delivery.

Qualifications

• Candidates typically bring 6 to 9 years of security engineering experience.
• Breadth across cloud security, network security and detection engineering, with depth in Azure and Microsoft Sentinel.
• Experience leading incident response for technical incidents, including post-incident reviews.
• Experience assessing the security of acquisitions.
• Familiarity with modern identity and authentication, including passkeys and privileged access.
• Experience hiring, line-managing and developing security engineers.
• Able to write a clear risk narrative and present it to leadership.
• Sound judgment on ambiguous problems, and good prioritization across competing demands.
• Experience managing security vendor relationships.
• Willing to stay close to the technical work: this is not a pure management role.

Requirements

• Lead security due diligence and post-close integration assessments as deal volume grows.
• Build and maintain a repeatable integration playbook: assessment checklist, risk scoring, remediation plan and day-one controls.
• Write clear risk narratives and recommendations for the CISO and deal teams.
• Lead the penetration test cycle: scoping, triage, remediation tracking and reporting to leadership.
• Own the SOC sync across Accelerant and Mission US/UK: shared priorities, escalation paths, handoffs and coverage gaps.
• Own the detection platform strategy, including Microsoft Sentinel cost and ingestion, without losing detection coverage.
• Act as incident response manager for technical incidents, leading the response from triage through to resolution.
• Own the technical incident response playbooks and keep them current.
• Lead lessons-learned reviews after incidents and recommend control changes, tracked through to completion.
• Run control reviews and recommend improvements where gaps appear.
• Act as the internal escalation point for the external SOC, advising on potential incidents that need more judgment.
• Build and lead the security engineering team: partner with the CISO to hire direct reports, then provide line management and technical direction, including assigning work, reviewing output and coaching.
• Manage the security tooling and service vendors in this area, including the full vendor lifecycle: selection, renewals, performance and escalations.
• Step into hands-on engineering and investigation work when the team needs it.

Preferred Qualifications

• Experience assessing acquisition targets or integrating acquired companies, including building repeatable playbooks.
• Experience running a recurring penetration testing or automated pentest program and driving remediation.
• Experience coordinating a SOC or managed detection provider across multiple entities or regions.
• Experience with Microsoft Sentinel and SIEM cost optimization.
• Experience securing AWS environments and working with Cloudflare.
• Experience rolling out phishing-resistant authentication such as passkeys or FIDO2.
• Certifications such as CISSP, CISM, GIAC, AZ-500 or SC-200.
• Experience in insurance, financial services or another regulated industry.