Director of Security Operations

National Debt Relief, LLC.•,

1d•$197,500 - $227,000•Remote

About The Position

The Director of Security Operations leads enterprise detection and response, owning incident response, endpoint detection and response, email security, SIEM and detection engineering, and the monitoring and automation that support these functions. The director sets the function’s strategy, staffing model, budget, and operating metrics, while remaining a hands-on player coach who serves as incident commander, builds detections, and reviews analyst work. The role partners with IT, engineering, legal, privacy, communications, and executive leadership to manage incidents, communicate risk, support compliance, and report program outcomes. It also owns the vendor strategy and budget for the detection and response stack.

Requirements

At least 10 years of information security experience, including at least 5 years focused on security operations, incident response, or detection engineering.
At least 5 years of direct people leadership experience, including hiring, performance management, and on-call ownership.
Experience owning a function-level budget, vendor relationships, and a staffing plan.
Bachelor’s degree in information systems, computer science, or a related field, or equivalent practical experience.
Hands-on operational experience with SIEM platforms, including query authoring, data modeling, and detection development.
Hands-on experience with EDR platforms, including policy design, containment actions, and threat hunting.
Experience operating email security controls and phishing response at scale.
Working knowledge of attacker tradecraft, including initial access, persistence, privilege escalation, lateral movement, and exfiltration.
Practical use of MITRE ATT&CK for coverage assessment and detection planning.
Incident response and forensic practice, including host and cloud artifact analysis, chain of custody, and timeline construction.
Cloud detection and response experience in AWS, Azure, or GCP, including identity-provider telemetry such as Okta or Entra ID.
Scripting and automation ability using Python, PowerShell, or similar tools for enrichment, response actions, and SOAR workflows.
Strong knowledge of TCP/IP, DNS, HTTP, and Windows and macOS operating-system internals.
Knowledge of secure configuration management and endpoint security technologies across multiple platforms.
Understanding of compliance areas including SOC 2, PCI DSS, and applicable state privacy and breach notification requirements.
Ability to remain calm and decisive during active incidents and communicate status clearly to technical and executive audiences.
Strong verbal and written communication, including translating technical risk into business terms for non-technical stakeholders.
Ability to build rapport and durable working relationships with business, IT, and engineering leaders.
Ability to influence without direct authority and position security as a pragmatic, value-added partner.
Strong documentation and communication skills.
Curious, inquisitive, innovative, lifelong learner, and self-starter.
Able to give, receive, and respond effectively to feedback.
Computer competency and ability to work with a computer.
Ability to prioritize multiple tasks and projects simultaneously.
Expected punctuality and consistent attendance.
Ability to meet high monthly performance expectations.
Ability to work in a fast-paced, high-volume setting and navigate multiple computer systems while multitasking.
Ability to remain calm and professional during difficult discussions and take constructive feedback.
Available for a full-time position.

Nice To Haves

Industry-recognized certification(s) are highly recommended: GCIH, GCIA, GCFA, CISSP, or CISM.

Responsibilities

Own the detection and response strategy and multi-year roadmap, aligned with enterprise risk, the threat landscape, and business priorities.
Lead, coach, and develop the security operations team, including hiring, scheduling, on-call rotation, performance management, succession planning, and career development.
Serve as a player coach by taking incident commander duty, writing detections, and performing hands-on analysis.
Own the incident response program, including the response plan, severity model, escalation paths, tabletop exercises, evidence handling, and post-incident reviews.
Own endpoint detection and response strategy and operations, including policy tuning, coverage assurance, containment workflows, and threat hunting.
Own email security, including phishing defense, SPF, DKIM, and DMARC controls, user reporting workflows, and responses to business email compromise attempts.
Own SIEM and detection engineering, including log-source onboarding, detection development and testing, alert quality, and false-positive reduction.
Build and maintain automation and runbooks to reduce response time and repetitive analyst work.
Develop threat-informed detection coverage mapped to MITRE ATT&CK and validate it through purple-team and control testing.
Define and report operational metrics, including mean time to detect, mean time to respond, alert volume and quality, coverage, and containment effectiveness.
Coordinate with IT, engineering, legal, privacy, and communications during incidents, including support for regulatory and customer notification decisions.
Own the budget, staffing plan, and vendor strategy for the detection and response stack, including managed service providers, tooling selection, and licensing.
Present program status, incident outcomes, and risk decisions to executive leadership, and support board, audit committee, and regulator reporting as requested.
Support audit and compliance requirements by providing evidence for monitoring, response, and control operation.