Director, RAAS l Managed Services

Aprio•Atlanta, GA

About The Position

Aprio is seeking a Director of Risk Advisory and Assurance Services (RAAS) Managed Services to build and lead a managed security services provider (MSSP) practice centered on the Microsoft security ecosystem. The practice will serve Defense Industrial Base (DIB) contractors, Department of Defense and federal organizations, and other regulated customers. This entrepreneurial role owns the service end to end, from defining the offering and establishing operations to winning initial customers and growing the practice into a scalable, profitable business line. The Director will work across technical delivery, business development, customer engagement, and executive leadership. The Director will define managed service offerings such as managed detection and response, vulnerability management, identity threat protection, and CMMC compliance monitoring, including service tiers, SLAs, and pricing. The role will develop go-to-market strategy and the Microsoft partnership, lead customer discovery and executive presentations, and contribute to proposals and federal and DoD contracting pursuits. On the technical and operational side, the Director will architect a scalable, multi-tenant security operations platform using Microsoft Sentinel and related Microsoft security products; establish SOC processes and 24x7 coverage models; lead detection engineering and automation; create repeatable customer onboarding; and define and report service KPIs. Services must be delivered in government environments and aligned with applicable defense, federal, data-handling, and compliance requirements. The Director will also ensure the MSSP's operations, personnel, and facilities meet the security and clearance requirements needed to serve defense customers. They will support customer assessments, audits, and ATO processes, recruit and develop the technical team, and serve as an escalation point for major incidents and critical customer issues.

Requirements

8–12 years of cybersecurity experience, including at least 3–5 years in a leadership role managing technical teams.
Demonstrated experience building or launching an MSSP, MDR, or managed SOC service, including service design, pricing, onboarding, and scaling to multiple customers.
Deep, hands-on expertise with Microsoft Sentinel, including architecture, data connectors, analytics rules, KQL, workbooks, and automation.
Strong working knowledge of Defender XDR (Endpoint, Identity, Office 365, and Cloud Apps), Defender for Cloud, Entra ID, and Azure security architecture.
Experience supporting Defense Industrial Base or DoD/federal customers, including GCC High or Azure Government environments.
Working knowledge of CMMC 2.0, NIST SP 800-171, DFARS 7012, and NIST 800-53.
Proven entrepreneurial track record building from an early stage, owning revenue or P&L, and operating amid ambiguity and limited resources.
Excellent communication skills and ability to translate technical risk for executives, program managers, and contracting officers.
U.S. citizenship.
Active DoD Secret clearance.
SC-200: Microsoft Certified: Security Operations Analyst Associate.
SC-100: Microsoft Certified: Cybersecurity Architect Expert, required or to be completed within 6 months of employment.
CISSP or CISM; at least one is required.
Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent experience.

Nice To Haves

Active TS/SCI clearance is strongly preferred.
Experience with other SIEM/SOAR platforms, such as Splunk or Elastic, and leading migrations to Microsoft Sentinel.
Background in incident response, threat hunting, or threat intelligence.
Experience with infrastructure-as-code (Bicep, Terraform, or ARM) and detection-as-code practices.
Familiarity with federal contracting, capture management, and contract vehicles.
Contributions to the Microsoft security community, such as Sentinel content hub contributions, blogs, conference talks, or MVP status.
Military or intelligence community background.
AZ-500: Microsoft Certified: Azure Security Engineer Associate.
SC-300: Microsoft Certified: Identity and Access Administrator Associate (Entra ID).
SC-401: Microsoft Certified: Information Security Administrator Associate (Purview).
CMMC CCP/CCA: Cyber AB Certified CMMC Professional/Assessor.

Responsibilities

Define the MSSP service catalog, including MDR, vulnerability management, identity threat protection, and CMMC compliance monitoring, along with service tiers, SLAs, and pricing models.
Partner with sales and business development on go-to-market strategy, solution positioning, proposals, and RFP/RFI responses, including federal and DoD contract vehicles.
Lead customer discovery, scoping, and executive presentations as the senior technical voice in customer pursuits.
Develop the Microsoft partnership to strengthen service capabilities and expand market presence.
Architect a scalable, multi-tenant security operations platform using Microsoft Sentinel, Defender XDR, Defender for Cloud, Entra ID, Intune, and Purview, with Azure Lighthouse and Defender multi-tenant management.
Establish SOC processes for triage, incident response, escalation, threat hunting, playbooks, and runbooks, including 24x7 coverage models.
Drive detection engineering and automation, including analytics rules, KQL hunting queries, workbooks, Logic Apps/SOAR playbooks, and Security Copilot use cases; manage content as code using CI/CD and Git.
Design repeatable customer onboarding, including data connector deployment, log source prioritization, ingestion cost optimization, and tuning.
Define service KPIs such as MTTD, MTTR, SLA attainment, false-positive rates, and customer satisfaction, and report them to customers and leadership.
Deliver services in Microsoft 365 GCC High, Azure Government, and DoD environments, aligned with data sovereignty and ITAR/CUI handling requirements.
Align service delivery with NIST SP 800-171, CMMC 2.0, DFARS 252.204-7012, NIST 800-53, and FedRAMP requirements.
Ensure the MSSP's operations, personnel, and facilities meet security and clearance requirements for defense customers.
Support customers through CMMC assessments, audits, and Authority to Operate (ATO) processes.
Recruit, hire, and develop SOC analysts, security engineers, and detection engineers, many of whom hold active clearances.
Build a high-performance team culture with clear career paths, certification plans, and on-call practices designed to avoid burnout.
Coach team leads and serve as the escalation point for major incidents and critical customer issues.

Benefits

Medical, dental, and vision insurance starting on the first day of employment.
Flexible Spending Account and Dependent Care Account.
401(k) with profit sharing.
9+ holidays and discretionary time off structure.
Parental leave coverage for primary and secondary caregivers.
Tuition Assistance Program and CPA support program with a cash incentive upon completion.
Discretionary incentive compensation based on firm, group, and individual performance.
Incentive compensation related to origination of new client sales.
Top-rated wellness program.
Flexible working environment, including remote and hybrid options.
Competitive compensation and industry-leading benefits.
Professional growth and advancement opportunities.