Associate Director, Security Operations

Morrison & Foerster, LLP•Washington, DC

15h

About The Position

The Associate Director of Security Operations is the Firm’s operational and technical authority across security operations, incident response, threat detection engineering, threat intelligence, and digital forensics. In a high-stakes legal environment, this leader is responsible for early threat detection and rigorous, legally defensible investigations into security, privacy, and internal workplace matters. This player-coach bridges strategic leadership and hands-on execution. The role oversees the Firm’s 24/7 Managed Detection and Response (MDR/MSSP) partner, manages one direct report, and serves as Incident Commander during critical security events. The Associate Director partners closely with the CISO, CIIO, Office of the General Counsel, and Enterprise Infrastructure and Cloud teams. A key objective is to increase operational leverage by maturing detection coverage, orchestrating response playbooks, and deploying SOAR automations before scaling headcount. The role also collaborates with the CISO on data-driven business cases for team expansion and specialized staff augmentation as the threat landscape and Firm requirements evolve.

Requirements

Bachelor’s degree in Information Security, Computer Science, Information Systems, Cybersecurity, or a related field.
10+ years building infrastructure and security programs, implementing and managing security solutions, and leading incident response.
3+ years leading or working in an enterprise Security Operations function.
Experience as incident commander during critical incidents, including running the bridge, directing third-party retainers, and operating under privilege.
Hands-on experience with digital forensics, evidence preservation, and chain of custody, and with investigations involving legal counsel, HR, or law enforcement.
Experience managing a 24x7 MSP or MSSP relationship against defined service levels.
Experience building SOAR automation and developing and refining response playbooks.
Experience running purple-team and tabletop exercises, including out-of-band communication scenarios.
Deep knowledge of incident response, cyber threat intelligence, threat hunting, insider threat, detection engineering, and threat modeling.
Deep expertise in MITRE ATT&CK, Attack Kill Chain analysis, and relevant frameworks.
Hands-on expertise with Microsoft Defender EDR/XDR, Microsoft Sentinel SIEM, Microsoft Purview, Mimecast, Recorded Future or similar platforms, and vulnerability-management tools.
Strong technical depth in network, systems, cloud, and application security, and current knowledge of SaaS and AI attack vectors.
Ability to balance strategic planning with hands-on execution and lead calmly and decisively under pressure during critical incidents.
Ability to use metrics and operational data to make the case for priorities, tools, and headcount.
Ability to influence without authority and build trusted relationships across a matrixed organization.
Ability to explain complex security issues clearly to lawyers, business leaders, and executives, in writing and in person.
Collaborative, low-ego approach and commitment to developing talent.

Nice To Haves

CISSP or equivalent certification is strongly preferred.
GIAC certifications such as GCIH, GCIA, GCFA, or GCTI.
Advanced degree.
Experience in a law firm or professional services environment.

Responsibilities

Lead the Firm’s incident response program, including preparation, testing, response, recovery, and lessons learned.
Serve as incident commander for critical incidents by running the response bridge, setting priorities, assigning work, and keeping leadership informed.
Hands-on triage, investigation, containment, resolution, and root-cause analysis of incidents; work with IT to address underlying weaknesses.
Engage and direct third-party retainers, including forensics firms and outside counsel, and conduct investigations under attorney-client privilege at counsel’s direction.
Develop, test, and refine response playbooks, including out-of-band communications plans for compromised primary systems.
Design and run tabletop exercises for technical teams and Firm leadership, and track corrective actions to completion.
Maintain 24x7x365 escalation paths with the MSP and participate in the off-hours on-call rotation.
Own the Firm’s security monitoring and response capabilities, including Microsoft Sentinel, Microsoft Defender, Mimecast, and related technologies.
Lead monitoring and analysis of security events across networks, endpoints, email, and cloud infrastructure; personally investigate high-severity alerts.
Own the 24x7 MSP relationship, set service levels, review performance, and hold the provider accountable.
Automate triage and response through SOAR to increase handling capacity without adding staff.
Help develop and enforce security policies, standards, and operating procedures that meet the Firm’s regulatory and client obligations.
Build, tune, and retire detections mapped to MITRE ATT&CK, and track coverage against the framework.
Conduct proactive threat hunts, including for SaaS, cloud, and AI-related attack vectors.
Run the cyber threat intelligence program, using sources such as Recorded Future to set detection and hunting priorities and brief leadership on relevant threats.
Use threat intelligence and vulnerability-management data to prioritize remediation with Infrastructure and Cloud teams; develop custom detections and mitigations for vulnerabilities that cannot be fixed quickly.
Lead threat modeling for critical systems, cloud services, and AI-enabled solutions.
Run purple-team exercises to validate controls and identify gaps in policy and procedure.
Build and operate insider-threat detection in partnership with Legal, HR, Privacy, and data-protection teams.
Use Microsoft Purview, BigID, and related platforms to detect and respond to data loss and misuse of client, Firm, and regulated information.
Define, document, and run the Firm’s investigations program for security, privacy, and workplace incidents.
Set practices for severity assessment, evidence capture and preservation, chain of custody, law-enforcement requests, and escalation to leadership.
Build digital forensics and incident response capability using internal staff and external providers.
Maintain investigation workflows and incident playbooks in the Firm’s systems of record.
Work with the CISO, General Counsel, senior lawyers, and business stakeholders to scope investigations, commission outside help, and coordinate status updates and internal communications.
Lead and develop one direct report while remaining hands-on in detections, investigations, and incidents.
Define and report operational metrics, including mean time to detect, mean time to respond, MITRE ATT&CK coverage, and MSP service-level performance.
Manage security operations vendor relationships and provide input on budget and tooling decisions.
Partner with the CISO to grow the team over time, supported by data-driven business cases for new staff or staff augmentation.
Foster accountability, continuous improvement, and service to the Firm’s lawyers and clients.

Benefits

Medical, dental, vision, life, and disability coverage options.
Parental leave and family benefits, including adoption and fertility treatment options and backup child and elder care.
Global wellness program, including free access to Talkspace and Calm apps.
Annual community service day.
Birthday holiday.
Annual education reimbursement.
Dedicated Talent Development team.
Competitive annual profit-sharing contribution.
Discretionary bonus may be available.
Overtime as applicable.
Retirement contributions.
Paid holidays.
PTO.