Director, Cybersecurity Operations

KLDiscovery • United States,

13d • $175,000 - $215,000 • Remote

About The Position

The Director, Cybersecurity Operations leads Security Operations and Incident Response, Security Engineering, Vulnerability Management, and Threat Intelligence. This is a hands-on, player-coach leadership role reporting directly to the CISO and partnering with the Director, Cyber GRC as part of one unified cyber team. The Director will bring technical depth and leadership capability to modernize security operations through MDR deployment, AI-informed detection, automation, and specialized security engineering functions.

The role oversees MDR operations and incident response, security engineering across endpoint, identity, cloud, and application security, threat intelligence, vulnerability management, control validation, AppSec, cloud security, and AI security. It also leads tooling strategy and automation, develops a lean engineering team, and provides regular security metrics and posture reporting to the CISO. This is a fully remote position.

Requirements

• 15 or more years of progressive information security experience, including at least 7 years in a security leadership role.
• Demonstrated ownership of a security operations or engineering function at Director or equivalent level.
• Experience operating and maturing an MDR deployment, such as CrowdStrike Falcon Complete, Arctic Wolf, Expel, or equivalent, in a corporate environment.
• Hands-on experience in at least two of security engineering, penetration testing/offensive security, cloud security, application security, or incident response.
• Demonstrated experience deploying or maturing security automation, such as SOAR playbooks, detection engineering, IaC security, or CI/CD pipeline security.
• Familiarity with cloud-native security in AWS, Azure, or GCP, including CSPM, cloud IAM, and workload protection.
• Working knowledge of cybersecurity frameworks such as NIST SP 800-171, ISO 27001, and SOC 2.
• Understanding of vulnerability management, including scanning, prioritization, remediation tracking, and SLA enforcement.
• Familiarity with AppSec disciplines, including SAST/DAST tooling, secure SDLC, and security gate integration into CI/CD.
• Understanding of IAM security governance, including PAM, access review programs, and SSO/MFA architecture, distinct from IT provisioning execution.
• Foundational awareness of CMMC requirements.
• Exceptional communication skills, including the ability to explain cyber risk and compliance concepts to executives, clients, and regulators.
• Ability to lead enterprise client security discussions, represent the company in due diligence meetings, and build trust with external stakeholders.
• Business-minded judgment to balance security requirements with commercial realities.
• Curiosity and adaptability in a fast-growing company and evolving regulatory and threat landscape.
• Discretion, sound judgment, confidentiality, and professionalism.
• Bachelor's degree in Information Security, Computer Science, Engineering, Business, or a related field.

Nice To Haves

• Experience with AI security considerations, including model testing, prompt injection, AI tool access governance, and frameworks such as NIST AI RMF and ISO 42001.
• Professional certifications such as CISSP, CISM, CISA, GPEN, GCIA, or other GIAC certifications.
• A master's degree or MBA with a security focus.

Responsibilities

• Own the MDR relationship, including SLA management, escalation accountability, detection tuning, and quarterly threat hunt reviews.
• Lead incident response, including runbooks, major incident coordination, executive communications during active incidents, and post-incident root cause analysis.
• Oversee SOC detection engineering and maintain, test, and tune SIEM rules, SOAR playbooks, and automated response actions.
• Direct and develop security analysts, shifting capacity toward MDR validation, threat hunt support, and stakeholder reporting.
• Oversee specialized security engineering lanes for endpoint, identity, cloud, and application security, with clear ownership, scope, and measurable outcomes.
• Drive security architecture reviews and engineering decisions for large or complex IT projects.
• Shape the security tooling strategy, evaluating, selecting, and retiring tools across endpoint, identity, cloud, and application security.
• Enforce automation-first engineering practices, including IaC security gates, CI/CD pipeline security, CSPM auto-remediation, and SOAR-driven response workflows.
• Operationalize threat intelligence by translating MDR findings and external threat data into detection updates, architecture decisions, and risk register inputs.
• Own the vulnerability management lifecycle, including scanning coverage, risk-based prioritization, remediation tracking, and SLA enforcement.
• Own the purple team and control validation program, confirming controls work as intended and detections trigger against known attack techniques.
• Drive threat modeling across engineering to identify attack paths and inform remediation priorities.
• Oversee AppSec, including secure SDLC, code review gates, SAST/DAST tooling, and collaboration with Product and Engineering teams.
• Own cloud security posture management, including CSPM, workload protection, cloud IAM governance, and cloud-native security architecture.
• Set team-wide AI security posture and oversee controls such as model security, prompt injection testing, and AI tool access governance.
• Mature MDR deployment by expanding coverage, improving response fidelity, and integrating outputs with internal SIEM, IAM, and compliance evidence workflows.
• Champion security automation to reduce manual work in detection, response, vulnerability tracking, and reporting.
• Evaluate emerging security technologies and make build, buy, or partner recommendations to the CISO.
• Lead, develop, and performance-manage a lean engineering team.
• Partner with the Director, Cyber GRC on risk register inputs, technical control compliance evidence, and security posture presentations.
• Provide the CISO with regular metrics and reporting on incident trends, control coverage, MDR performance, vulnerability posture, and team development.
• Build a culture of continuous improvement, automation-first execution, proactive security, threat hunting, and control validation.

Benefits

• Competitive total compensation, including base pay and bonus potential.
• Inclusive benefits.
• Wellness programs and perks.
• Depending on location and eligibility, comprehensive health and wellness benefits, retirement and financial programs, paid time off and leave options, employee assistance resources, and professional development opportunities.
• Remote work opportunities intended to support work-life balance.

What This Job Offers

• Job Type: Full-time
• Career Level: Director