Manager, Detection & Incident Response

Squarespace•New York, NY

1d•Hybrid

About The Position

Squarespace is seeking a skilled and detail-oriented technical leader to own the day-to-day operations of our Detection and Incident Response team. Reporting to the VP of Security / CISO, you will be the driving force behind our SIEM and SOAR capabilities and incident response program. You’ll partner with teams throughout Squarespace to improve how we spot and respond to threats, leading the group that identifies and handles security threats as they happen.

Requirements

Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent experience).
7+ years of experience in cybersecurity, with at least 2 years in a leadership or team-lead role.
Deep expertise in Incident Response and Detection Engineering.
Strong knowledge of cloud security operations, specifically within AWS or GCP environments.
Hands-on experience managing and tuning SIEM and SOAR platforms.
Experience automating security workflows and incident response playbooks to reduce manual effort.
Familiarity with security frameworks such as MITRE ATT&CK and NIST.
Excellent communication skills with the ability to lead technical teams during high-pressure incidents and explain complex threats to non-technical stakeholders.
Knowledge of software development, design and technical operations.

Responsibilities

Contribute to define, collect, and analyze security KPIs and KRIs for the security organization.
Develop and implement a comprehensive detection and response strategy and roadmap aligned with Squarespace's overall business objectives and risk appetite. This goes beyond just "implementing new security programs" to encompass a holistic vision.
Oversee the Security Operations Center (SOC) activities, including threat detection, monitoring, analysis, and proactive hunting, ensuring 24/7/365 coverage as appropriate.
Own the health and effectiveness of the SIEM and SOAR platforms, ensuring high-quality data ingestion, alert tuning, and automated response logic. x
Establish and maintain a robust incident response program, including defining incident playbooks, leading major incident investigations, and conducting post-incident reviews to drive continuous improvement.
Design and lead regular tabletop exercises to test the organization’s readiness for various incident scenarios.
Serve as the Incident Commander for major security events, coordinating with teams such as Legal, Communications, and HR to ensure clear internal communication and regulatory compliance.
Identify, evaluate, and implement new security technologies and tools to enhance detection, prevention, and response capabilities.
Drive continuous improvement of security operations processes through automation, tooling, and best practices.
Stay abreast of emerging security threats, vulnerabilities, and industry trends and proactively advise leadership on necessary adjustments to strengthen Squarespace's security posture.
Build, mentor, and lead a high-performing team of security professionals, fostering a culture of continuous learning, collaboration, and accountability.
Act as a key liaison and trusted advisor to internal stakeholders (e.g., Engineering, Product, Legal, Compliance, IT) on security-related matters.
Manage relationships with external security vendors and partners, ensuring effective service delivery and technology adoption.
Serve as a calm and decisive leader during security events, ensuring the team stays focused while stakeholders remain informed.
Proactively work with partner teams to implement new security programs and refine existing ones.
Work collaboratively with partner teams to define implementation patterns that improve security while not negatively affecting Customer or employee engagement.
Drive improvements to the team’s operational velocity and response efficiency.