Manager, Security Operations & Incident Response

Davis Polk & Wardwell LLP•New York, NY

1d•$240,000 - $300,000

About The Position

The Manager, Security Operations & Incident Response leads the Firm’s capabilities to detect security threats and respond when preventive controls fail. This hands-on leadership role owns incident command, detection engineering, exposure management, threat intelligence, and governance of the Firm’s managed detection and response provider. The manager builds, leads, and develops a small, senior team and works directly with the Firm’s General Counsel’s office and outside counsel.

Requirements

Demonstrated incident command during live security incidents, including direct coordination with legal counsel.
Hands-on depth with SIEM, endpoint detection and response, and detection engineering.
Experience governing a managed security service provider, including reviewing the quality of provider output.
Practical command of MITRE ATT&CK and familiarity with NIST SP 800-61, the NIST Cybersecurity Framework, and ISO 27001.
Experience driving vulnerability and exposure remediation through teams outside the direct reporting line.
Calm, structured judgment under pressure, including a willingness to clearly state what is not yet known rather than prematurely declare an incident contained.
Written communication suitable for review by counsel and Firm leadership, strong interpersonal skills, and the ability to influence at all organizational levels.
Strong work ethic and excellent discretion and judgment when handling privileged and market-sensitive information.
Degree in Information Technology, Engineering, or a related field.
At least 8 years of information security experience, including at least 3 years leading incident response or security operations.

Nice To Haves

Experience in a law firm, professional services firm, or financial institution.
Industry certifications such as GCIH, GCFA, GCIA, CISSP, or CISM.

Responsibilities

Serve as incident commander for security incidents, directing containment, evidence preservation, scope determination, eradication, and recovery.
Operate the incident response framework, including triaging Events of Interest and incidents, determining severity, and escalating as appropriate.
Produce incident documentation to the Firm’s evidentiary standard and coordinate with internal and external stakeholders, including on matters conducted under legal privilege.
Support the CISO on notification analysis, cyber insurance, and law enforcement engagement.
Lead post-incident reviews, drive root-cause remediation through responsible owners, and design and conduct tabletop exercises, including exercises involving Firm leadership and counsel.
Own the detection program across SIEM, endpoint, identity, email, and browser telemetry, including use-case development, tuning, and lifecycle management.
Measure and report detection coverage against prioritized MITRE ATT&CK techniques and manage alert quality and false-positive rates.
Own the operational relationship with the managed detection and response provider, including escalation paths, provider-output quality reviews, service-level performance, and scope expansion.
Own the exposure management cycle across vulnerabilities, misconfigurations, attack paths, and internet-facing exposure; prioritize based on known exploitation, asset criticality, and privilege, and independently verify remediation.
Translate threat intelligence into detections, hunts, and briefings; track threat activity relevant to the legal sector and the Firm’s client base; and oversee monitoring and takedown of brand impersonation and lookalike domains.
Lead, develop, and grow a team of security analysts and engineers, setting priorities, quality standards, and on-call expectations.
Provide operational input to security engineering on control design and to governance and compliance on risk, metrics, and audit evidence.