Cybersecurity Engineering & Operations Director

Onit, Inc.

1d•$150,000 - $190,000

About The Position

Onit is seeking a Director of Cybersecurity Engineering & Operations to lead the technical cybersecurity function across our AI-driven legal operations SaaS platforms and corporate infrastructure. Reporting to the Vice President, Compliance and Security, this highly technical leader translates the organization's cybersecurity strategy into security architecture, engineering capabilities, and security operations that protect our products, cloud environments, employees, and corporate systems. The Director leads a cybersecurity manager and a team of security engineers and operations professionals, and partners closely with Cloud Engineering, Product Engineering, IT, and Compliance to reduce risk while enabling the company to build and operate securely.

Requirements

10+ years of progressive cybersecurity experience, including 5+ years in security leadership or management roles leading security engineering, security operations, or cloud security functions, with experience managing managers and technical teams.
Deep expertise securing cloud-native enterprise SaaS applications, with strong hands-on AWS security experience (IAM, VPC, EC2, RDS, S3, EKS/ECS, logging, monitoring) and strong knowledge of Linux, networking, containers, and Kubernetes.
Strong experience with security technologies including SIEM, EDR, CSPM, vulnerability management, WAF, and security monitoring platforms, and demonstrated experience building or improving incident detection and response programs.
Experience securing Microsoft 365 and Entra ID environments (identity protection, MFA, Conditional Access, privileged identity management, access governance) and implementing privileged access management and Just-In-Time access architectures.
Strong understanding of application and API security (SAST, DAST, SCA, SBOMs, secrets management, authentication/authorization) and experience with security automation and scripting using Python, Bash, Terraform, APIs, and CI/CD platforms, including Infrastructure-as-Code security and policy-as-code guardrails.
Hands-on AI tool proficiency: experience using AI tools and LLM-based assistants in security work (e.g., AI-assisted alert triage, investigation, detection engineering, and automation), including crafting effective prompts, evaluating output accuracy, and integrating AI into security workflows.
Ability to communicate complex cybersecurity risks to engineering leaders, executives, and non-technical stakeholders, and to balance risk reduction with business objectives and engineering velocity.

Nice To Haves

Experience securing AI-enabled applications, LLM integrations, and APIs is a plus.
Experience with multi-tenant SaaS security, CrowdStrike, Cloudflare (WAF and Zero Trust), DevSecOps, and offensive security or red-team programs.
Familiarity with SOC 2, ISO 27001, NIST, or FedRAMP technical controls.
Certifications such as CISSP, CCSP, AWS Security Specialty, or GIAC.

Responsibilities

Develop and execute the cybersecurity engineering and operations strategy with the VP, Compliance and Security, translating risk and business priorities into technical roadmaps, architecture standards, and measurable outcomes (e.g., remediation performance, control coverage, incident response effectiveness, attack surface and posture trends).
Lead the design and continuous improvement of security controls and guardrails across AWS and corporate environments, including cloud identity, network, workload, container/Kubernetes, and data protections, with security automation delivered as code (Terraform, Python, CI/CD, policy-as-code).
Own technical security operations and incident response: detection, investigation, containment, eradication, and recovery; maintain and exercise IR plans, playbooks, and runbooks; build automated detection and response workflows across SIEM, SOAR, EDR, and cloud-native tooling; and coordinate executive, legal, and regulatory escalation with the VP.
Own the vulnerability and exposure management program across applications, cloud, endpoints, and external attack surfaces, setting risk-based remediation SLAs and prioritizing by exploitability, exposure, and business impact while driving root-cause fixes for systemic weaknesses.
Provide security leadership for Microsoft 365 and Entra ID (MFA, Conditional Access, privileged identity management, Just-In-Time access), corporate endpoint and email security, and for application and product security across the SDLC, including SAST/DAST/SCA, SBOMs, API security, threat modeling, a security champions program, and AI-enabled applications and integrations.
Lead, mentor, and develop the cybersecurity manager, engineers, and security operations staff; define team structure, career paths, and operating processes that scale; manage security vendors, penetration testing, and managed security services; and serve as senior technical security advisor to Engineering, IT, Product, and executive leadership.

Benefits

Three medical plan options, plus dental and vision
Employer contribution to HSA for HDHP plan participants
401(k) with a 100% match on the first 3% and 50% on the next 2% of employee contributions
Flexible paid time off
7 sick days
9 paid company holidays annually
Exceptional paid leave for birth parents, non-birth parents, and caregivers
Surrogacy and adoption reimbursement
100% employer-paid life and disability insurance
Voluntary benefits including hospital indemnity, critical illness, accident, and pet insurance
Healthcare FSA, HSA, and dependent care FSA
One paid volunteer day each year