Cyber Defense Unit Manager

Acronis•Burlington, MA

About The Position

Acronis is seeking an experienced Cyber Defense Unit Manager to lead and strengthen its global cyber defense capabilities. The role owns security operations, threat detection, incident response, threat intelligence, and proactive defense. The manager will build a high-performing team and improve the organization’s ability to anticipate, detect, and respond to evolving cyber threats. The position combines cybersecurity expertise, operational leadership, and people management in a fast-paced global technology environment, moving between strategy, hands-on operations, major incidents, and executive communication. The role sets the Cyber Defense function’s strategy, roadmap, operating model, and maturity improvements; manages a global team; and oversees 24x7 monitoring, threat hunting, detection engineering, incident response, threat intelligence, and cyber defense technology. It also establishes performance metrics and reports posture, incidents, and risk trends to senior leadership and, when needed, the Board and Audit Committee. The manager partners across Security, IT, Cloud, Engineering, Product Security, Legal, and other teams to strengthen the organization’s overall security posture.

Requirements

Typically 10 or more years of significant cybersecurity experience in security operations, incident response, threat detection, or cyber defense.
Five or more years of experience leading teams.
Experience leading cybersecurity teams in a global technology or software environment, including distributed, multi-time-zone teams.
Demonstrated experience leading major incident response efforts from detection through recovery and post-incident review.
Strong understanding of modern attacker techniques, threat actor tradecraft, and frameworks such as MITRE ATT&CK.
Hands-on knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, and security monitoring technologies, including their evaluation and optimization.
Experience with threat hunting and detection engineering, including detection-as-code practices.
Strong understanding of AWS, Azure, or other modern cloud environments, including cloud-native logging, detection, and response.
Experience with digital forensics and investigations, and working knowledge of breach notification and regulatory requirements.
Experience leveraging automation and scripting, such as Python, in security operations.
Experience managing budgets, vendors, and managed security service providers.
Strong leadership, analytical, and decision-making skills, particularly during high-pressure incidents.
Ability to communicate complex cybersecurity risks clearly to technical and executive stakeholders, including legal and board audiences.
High integrity and sound judgment when handling sensitive, confidential, and privileged information.

Nice To Haves

Experience leveraging AI within security operations.
Relevant certifications such as CISSP, CISM, GIAC (GCIH, GCFA, GCTI, GCDA), or OSCP.

Responsibilities

Lead the Cyber Defense function, including its strategy, roadmap, operating model, and continuous maturity improvement.
Manage, mentor, and develop a global team of analysts, responders, threat hunters, and detection engineers, with coverage across time zones.
Define the function’s build-versus-buy approach; manage MDR/MSSP and other external partners; and oversee the Cyber Defense budget.
Oversee 24x7 security monitoring, alert triage, investigation, and escalation across endpoints, networks, identities, applications, and cloud environments.
Establish and maintain SOC processes, runbooks, severity definitions, and handoffs.
Lead proactive, hypothesis-driven threat hunting and attack surface monitoring, including identity-based and cloud-native threats.
Own the detection engineering lifecycle, including use case development, testing, tuning, deployment, and retirement, and reduce false positives and alert fatigue.
Map detection coverage to MITRE ATT&CK, identify gaps, and prioritize improvements based on threat relevance and business risk.
Define log source requirements and onboarding priorities with IT, Cloud, and Engineering to ensure telemetry completeness.
Run purple team and adversary emulation exercises to validate detection and response effectiveness.
Lead response to significant cybersecurity incidents in coordination with Security, IT, Engineering, Legal, Communications, and executive leadership.
Maintain and test incident response plans, playbooks, and crisis communication procedures, including tabletop exercises with senior stakeholders.
Oversee digital forensics, evidence handling, containment, eradication, and recovery; work with Legal on privilege, investigations, legal holds, and regulatory inquiries.
Support breach assessment and regulatory notification decisions with Legal and Compliance.
Run post-incident reviews and drive corrective actions to closure.
Build and manage a threat intelligence capability tracking relevant threat actors, campaigns, and techniques.
Translate intelligence into actionable detections, hunts, blocking actions, and risk-informed recommendations for leadership.
Participate in industry intelligence-sharing communities and partnerships, such as ISACs, peer groups, and law enforcement liaison.
Own and optimize cyber defense technologies, including SIEM, EDR/XDR, SOAR, and threat intelligence platforms; manage their roadmap, integrations, and vendor performance.
Drive automation and AI-assisted capabilities for detection, enrichment, triage, investigation, and response, with appropriate governance and human oversight.
Leverage Acronis products and platform capabilities where appropriate to strengthen internal defense.
Establish KPIs and reporting for cyber defense effectiveness, including MTTD, MTTR, detection coverage, alert quality, incident trends, and threat exposure.
Report cyber defense posture, major incidents, and risk trends to senior leadership and, when needed, the Board and Audit Committee.
Partner with Security leadership, IT, Cloud, Engineering, Product Security, and Legal to strengthen the company’s overall security posture.
Coordinate with Vulnerability Management and Product Security on exploitable risks, emergency patching, and threat-informed prioritization.
Support audits, customer assurance requests, and regulatory requirements related to monitoring and incident response.