Cyber Defense Unit Manager

Acronis•Burlington, MA

4d•$170,000 - $260,000

About The Position

Acronis is seeking an experienced Cyber Defense Unit Manager to lead and strengthen its global cyber defense capabilities. The role owns security operations, threat detection, incident response, threat intelligence, and proactive defense. The manager will build a high-performing team and continuously improve the organization’s ability to anticipate, detect, and respond to evolving cyber threats. The position combines cybersecurity expertise, operational leadership, and people management in a fast-paced global technology environment, with work spanning strategy, hands-on operations, major incidents, and executive communication. The manager leads the Cyber Defense function’s strategy, roadmap, operating model, and maturity improvements; develops a global team; manages external security partners and the function’s budget; and oversees 24x7 monitoring, threat hunting, detection engineering, incident response, and threat intelligence. The role also owns cyber defense technologies and automation, establishes effectiveness metrics, reports posture and risks to senior leadership and, when needed, the Board and Audit Committee, and partners across Security, IT, Cloud, Engineering, Product Security, Legal, and Compliance. Acronis is a Swiss company founded in Singapore in 2003, with 15 offices worldwide and employees in more than 50 countries. Its corporate culture emphasizes innovation, accountability, impact, ownership, resilience, adaptability, and continuous improvement. The US pay range is $170,000–$260,000 in total target annual compensation. The role includes medical, dental, and vision coverage, flexible spending accounts, disability and life insurance, a 401(k) retirement plan with company match, and a generous vacation policy.

Requirements

Typically 10 or more years of significant cybersecurity experience in security operations, incident response, threat detection, or cyber defense.
At least 5 years of experience leading teams.
Experience leading cybersecurity teams in a global technology or software environment, including distributed, multi-time-zone teams.
Demonstrated experience leading major incident response from detection through recovery and post-incident review.
Strong understanding of modern attacker techniques, threat actor tradecraft, and frameworks such as MITRE ATT&CK.
Hands-on knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, and security monitoring technologies, including their evaluation and optimization.
Experience with threat hunting and detection engineering, including detection-as-code practices.
Strong understanding of AWS, Azure, or other modern cloud environments, including cloud-native logging, detection, and response.
Experience with digital forensics and investigations, and working knowledge of breach notification and regulatory requirements.
Experience leveraging automation and scripting, such as Python, in security operations.
Experience managing budgets, vendors, and managed security service providers.
Strong leadership, analytical, and decision-making skills, particularly during high-pressure incidents.
Ability to communicate complex cybersecurity risks clearly to technical and executive stakeholders, including legal and board audiences.
High integrity and sound judgment when handling sensitive, confidential, and privileged information.
Candidates are asked to participate in interviews without AI tools or external prompts; the process includes in-person interviews and requests removal of virtual backgrounds.
A full criminal, education, and identification background check is required for all new hires.

Nice To Haves

Experience leveraging AI within security operations.
Relevant certifications such as CISSP, CISM, GIAC (GCIH, GCFA, GCTI, GCDA), or OSCP.

Responsibilities

Lead the Cyber Defense function, including strategy, roadmap, operating model, and continuous maturity improvement.
Manage, mentor, and develop a global team of analysts, responders, threat hunters, and detection engineers, with coverage across time zones.
Define the build-versus-buy approach; manage MDR/MSSP and other external partners; and manage the Cyber Defense budget.
Oversee 24x7 security monitoring, alert triage, investigation, and escalation across endpoints, networks, identities, applications, and cloud environments.
Establish and maintain SOC processes, runbooks, severity definitions, and handoffs.
Lead proactive, hypothesis-driven threat hunting and attack surface monitoring, including identity-based and cloud-native threats.
Own the detection engineering lifecycle, including use case development, testing, tuning, deployment, and retirement; reduce false positives and alert fatigue.
Map detection coverage to MITRE ATT&CK, identify gaps, and prioritize improvements based on threat relevance and business risk.
Define log source requirements and telemetry onboarding priorities with IT, Cloud, and Engineering.
Run purple team and adversary emulation exercises to validate detection and response effectiveness.
Lead significant cybersecurity incident response, coordinating across Security, IT, Engineering, Legal, Communications, and executive leadership.
Maintain and test incident response plans, playbooks, and crisis communication procedures, including tabletop exercises with senior stakeholders.
Oversee digital forensics, evidence handling, containment, eradication, and recovery; work with Legal on privilege, investigations, legal holds, and regulatory inquiries.
Support breach assessment and regulatory notification decisions with Legal and Compliance.
Run post-incident reviews and drive corrective actions to closure.
Build and manage a threat intelligence capability tracking relevant threat actors, campaigns, and techniques.
Translate threat intelligence into detections, hunts, blocking actions, and risk-informed recommendations for leadership.
Participate in industry intelligence-sharing communities and partnerships, including ISACs, peer groups, and law enforcement liaison.
Own and optimize SIEM, EDR/XDR, SOAR, and threat intelligence platforms, including roadmap, integrations, and vendor performance.
Drive automation and AI-assisted capabilities for detection, enrichment, triage, investigation, and response, with governance and human oversight.
Use Acronis products and platform capabilities where appropriate to strengthen internal defense.
Establish and report KPIs for cyber defense effectiveness, including MTTD, MTTR, detection coverage, alert quality, incident trends, and threat exposure.
Report cyber defense posture, major incidents, and risk trends to senior leadership and, when needed, the Board and Audit Committee.
Partner with Security leadership, IT, Cloud, Engineering, Product Security, and Legal to strengthen the company’s overall security posture.
Coordinate with Vulnerability Management and Product Security on exploitable risks, emergency patching, and threat-informed prioritization.
Support audits, customer assurance requests, and regulatory requirements related to monitoring and incident response.