Director of Security Operations

Abridge•San Francisco, CA

26d

About The Position

The Director of Security Operations is a critical leadership position responsible for defining, executing, and maturing the organization's 24/7 operational security posture. You'll lead a multidisciplinary set of teams focused on preventing, detecting, analyzing, and responding to security threats across the entire enterprise-from corporate infrastructure to production environments. This role requires exceptional strategic leadership, deep technical understanding, and a commitment to operational excellence, security automation, and threat intelligence integration. You will report directly to the Chief Information Security Officer (CISO).

Requirements

Experience: 10+ years of senior leadership experience in security, with a minimum of 7+ years specifically in Security Operations, leading security teams, programs, or large-scale initiatives with a focus on threat detection engineering and incident response for a global SaaS company.
Business Acumen: Demonstrated experience running security as a business unit, including budget management, strategic forecasting, and translating technical risk into clear business impact (ROI) for executive leadership and the board.
Technical Depth: Deep technical expertise in operating and securing enterprise environments, including hands-on familiarity with SIEM/SOAR technologies and cloud security principles (GCP, AWS, or Azure).
Regulatory Knowledge: Proven experience operating in highly regulated industries, with strong knowledge of relevant security and privacy frameworks (e.g., NIST 800-53 / 800-171, FedRAMP, HIPAA, NIS2, etc.).
Communication: Exceptional communication and presentation skills, with the ability to convey complex security issues and operational risks to both highly technical teams and non-technical audiences, including executives, boards, customers, and government agencies.

Responsibilities

Strategic Leadership & Operational Excellence
Security Strategy: Define and continuously evolve the strategy, vision, and roadmap for the Security Operations function, ensuring alignment with overall business objectives and risk tolerance.
Financial Oversight: Manage the Security Operations budget, including forecasting expenditures for security tools, managed service providers, and personnel resource allocation.
Metric-Driven Management: Define, track, and report on key performance indicators (KPIs) and security metrics such as Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), overall program effectiveness, and operational efficiency metrics such as tracking of true positives, total security events, security investigations, and alert fidelity.
People & Program Leadership: Serve as a motivating people leader for a growing, globally-distributed team, providing career development, mentorship, and regular performance feedback.
Core Security Operations Functions
Threat Response: Develop a team to lead and manage the 24/7 threat detection and response function, overseeing incident triage, escalation, and coordination for all security events and incidents.
Investigations and Forensics: Develop a team that takes point on technical investigations and digital forensics. Establish and maintain digital forensics capabilities and chain-of-custody procedures.
Threat Detection Engineering: Oversee the lifecycle of all detection-as-code, security alerts, rules, and logic. Drive the development and implementation of advanced threat detection content (e.g., SIEM correlation rules, EDR signatures) based on the MITRE ATT&CK framework.
Threat Intelligence: Establish a formal Threat Intelligence program, including collection, analysis, enrichment, and dissemination of relevant threat information to inform detection and response strategies.
Security Infrastructure & Engineering
Security Infrastructure Engineering: Develop a team to lead and define the architecture, deployment, and optimization of core security infrastructure, including the Security Information and Event Management (SIEM) system and Security Orchestration, Automation, and Response (SOAR) platform.
Security Services Automation: Drive the development and implementation of security automation across the organization to reduce manual effort, increase operational speed, and enforce security policy compliance at scale.
Data Engineering: Oversee security data engineering efforts, focusing on building and maintaining robust data pipelines, data lakes, and lakehouses to ensure high-quality, normalized security event data is available for threat detection and forensic analysis.
Offensive Security & Enterprise Security
Offensive Security: Own the management of the Red Team and Purple Team programs. Oversee and coordinate internal and external penetration testing engagements, translating findings into actionable remediation plans.
Enterprise Security: Develop a team to lead the security architecture, engineering, and operations of the corporate IT infrastructure, including: securing the SaaS ecosystem (leveraging SSPM), defining the authentication/authorization architecture, overseeing the Third-Party Risk Management (TPRM) program (supplier / supply-chain security), Identity and Access Management (IAM), endpoint security (EDR/XDR), email security, and network security controls (network monitoring, firewalls, zero-trust components).
Physical Security / Life Safety
Physical Security: Develop a team to lead and manage the physical security / life safety program for all corporate offices, including access control systems, video surveillance, and alarm monitoring.
Life Safety Compliance: Partner with Facilities/Real Estate and Ops teams to ensure all physical security measures align with local life safety codes and regulations.
International Travel Program: Partner with HR, Legal, and other departments to develop a travel policy and program that tracks and manages international travel, provides for security protections when appropriate, and manages risk accordingly.
Crisis Management
Cross-Functional Leadership: Lead the overall security response during major incidents and crises, serving as the senior-most security leader in cross-functional crisis management exercises and real-world events.
Communications and Coordination: Assist in developing and leading the strategy and execution for internal communication (e.g., executive status updates) and external communication (e.g., working with PR/Legal) during high-severity security incidents.
Coordination & Information Sharing: Establish and maintain relationships for effective coordination with external entities, including regulatory bodies, law enforcement, and government to private sector information sharing groups.

Benefits

Generous Time Off: 14 paid holidays, flexible PTO for salaried employees, and accrued time off for hourly employees
Comprehensive Health Plans: Medical, Dental, and Vision coverage for all full-time employees and their families.
Generous HSA Contribution: If you choose a High Deductible Health Plan, Abridge makes monthly contributions to your HSA.
Paid Parental Leave: Generous paid parental leave for all full-time employees.
Family Forming Benefits: Resources and financial support to help you build your family.
401(k) Matching: Contribution matching to help invest in your future.
Personal Device Allowance: Tax free funds for personal device usage.
Pre-tax Benefits: Access to Flexible Spending Accounts (FSA) and Commuter Benefits.
Lifestyle Wallet: Monthly contributions for fitness, professional development, coworking, and more.
Mental Health Support: Dedicated access to therapy and coaching to help you reach your goals.
Sabbatical Leave: Paid Sabbatical Leave after 5 years of employment.
Compensation and Equity: Competitive compensation and equity grants for full time employees.
... and much more!