Director, Security Operations

Accelerant

16h

About The Position

Accelerant is hiring a senior, hands-on security leader to own high-judgment security work and report directly to the Chief Information Security Officer (CISO). The Director sets technical direction for the security operations team, remains close to technical work, and acts as the CISO’s trusted deputy for technical security and security operations, including matters involving the threat landscape, vulnerabilities, and incidents. The role is responsible for strategic direction of technical security operations, controls, and processes. It includes assessing the security of mergers and acquisitions, owning the penetration test cycle, coordinating purple team exercises and SOC operations, and serving as a technical expert on projects. The Director has autonomy to drive technical initiatives from concept through delivery. The position leads security due diligence and post-close integration assessments, develops repeatable integration playbooks, manages penetration testing and SOC coordination across Accelerant and Mission US/UK, and oversees detection platform strategy. The Director manages technical incident response, playbooks, lessons-learned reviews, and control improvements; leads and develops the security engineering team; and manages relevant security tooling and service vendors. The role also involves hands-on engineering and investigation when needed.

Requirements

Typically 6 to 9 years of security engineering experience.
Breadth across cloud security, network security, and detection engineering, with depth in Azure and Microsoft Sentinel.
Experience leading incident response for technical incidents, including post-incident reviews.
Experience assessing the security of acquisitions.
Familiarity with modern identity and authentication, including passkeys and privileged access.
Experience hiring, line-managing, and developing security engineers.
Ability to write clear risk narratives and present them to leadership.
Sound judgment on ambiguous problems and the ability to prioritize competing demands.
Experience managing security vendor relationships.
Willingness to stay close to technical work; this is not a pure management role.

Nice To Haves

Experience assessing acquisition targets or integrating acquired companies, including building repeatable playbooks.
Experience running a recurring penetration testing or automated pentest program and driving remediation.
Experience coordinating a SOC or managed detection provider across multiple entities or regions.
Experience with Microsoft Sentinel and SIEM cost optimization.
Experience securing AWS environments and working with Cloudflare.
Experience rolling out phishing-resistant authentication such as passkeys or FIDO2.
Certifications such as CISSP, CISM, GIAC, AZ-500, or SC-200.
Experience in insurance, financial services, or another regulated industry.

Responsibilities

Lead security due diligence and post-close integration assessments for mergers and acquisitions.
Build and maintain a repeatable M&A integration playbook covering assessment checklists, risk scoring, remediation plans, and day-one controls.
Write clear risk narratives and recommendations for the CISO and deal teams.
Lead the penetration test cycle, including scoping, triage, remediation tracking, and leadership reporting.
Own SOC coordination across Accelerant and Mission US/UK, including shared priorities, escalation paths, handoffs, and coverage gaps.
Own detection platform strategy, including Microsoft Sentinel cost and ingestion, while maintaining detection coverage.
Manage technical incident response from triage through resolution.
Own and maintain technical incident response playbooks.
Lead post-incident lessons-learned reviews and recommend control changes, tracking them through completion.
Run control reviews and recommend improvements when gaps are identified.
Serve as the internal escalation point for the external SOC, advising on potential incidents that require additional judgment.
Build and lead the security engineering team in partnership with the CISO, including hiring direct reports, line management, assigning work, reviewing output, and coaching.
Manage security tooling and service vendors across selection, renewals, performance, and escalations.
Perform hands-on engineering and investigation work when needed.
Set technical direction for the security operations team and drive technical initiatives from concept to delivery.