Security Operations Lead

Pelico • Miami, FL

1d • Hybrid

About The Position

Pelico is hiring a hands-on Security Operations Lead to own the operational effectiveness of its security monitoring, incident response, and vulnerability management capabilities. The role turns security alerts and findings into investigations, prioritized remediation, and measurable risk reduction, building a security operations foundation that protects the platform, supports enterprise customers, and enables future regulated deployments. The lead works closely with the CISO, Engineering, IT, and external security partners to build reliable, scalable operations while minimizing friction for product development and delivery.

The position owns security monitoring, detection, incident response, and vulnerability management. It includes operating SIEM and SOAR capabilities alongside a managed SOC; maintaining telemetry and detection coverage across cloud, application, and identity environments; and establishing dependable monitoring and escalation processes. The lead also oversees CNAPP operations, remediation workflows, security testing, cloud security improvements, secure delivery controls, operational evidence, and readiness for customer and regulatory assurance.

Pelico is a manufacturing orchestration platform company founded in 2019, headquartered in Paris with offices in Miami, London, and Amsterdam. The company describes its work as connecting supply chain, production, and quality data and using AI to anticipate disruptions and coordinate recovery. The role offers meaningful equity, market-benchmarked competitive salary, flexible hybrid work, health, dental, and vision coverage, and the opportunity to work with complex manufacturing operations. Pelico is an equal opportunity employer committed to a diverse and inclusive workplace.

Requirements

• Strong hands-on experience in security operations, cloud security, or DevSecOps, with direct ownership of production security capabilities.
• Experience deploying and operating SIEM solutions, building and tuning detections, investigating alerts, and partnering with an internal or managed SOC.
• Practical experience with SOAR or security automation, including integrations, enrichment, and safe response workflows.
• Experience operating a CNAPP or equivalent cloud and workload security tooling, and driving findings through remediation and verifying fixes.
• Solid understanding of cloud IAM, networking, logging, containers, Kubernetes, and infrastructure as code, including how misconfigurations and vulnerabilities combine into exploitable attack paths.
• Familiarity with secure SDLC practices, CI/CD, dependency and container scanning, secrets detection, and vulnerability remediation.
• Ability to automate security workflows using Python, shell scripting, APIs, or equivalent tools.
• Experience coordinating technical incident response and communicating clearly under pressure, with sound judgment around containment, escalation, and approval requirements.
• Ability to influence Engineering teams, translate technical findings into practical fixes, and balance security urgency with business and operational constraints.
• Strong written communication in English, disciplined documentation, and comfort working across US and European teams.
• Active adoption of AI tools at work, curiosity about their potential, and hands-on experience with AI-assisted workflows.

Nice To Haves

• Experience with Azure security and cloud-native production environments.
• Experience supporting ISO 27001, SOC 2, enterprise customer security requirements, or independent security testing programs.
• Familiarity with US defense-related requirements such as DoD IL5, NIST SP 800-171, CMMC, or ITAR, including shared-responsibility models and controlled-data boundaries.
• Experience building a security operations capability in a growing SaaS company.

Responsibilities

• Own security monitoring, detection, and incident response, including implementing and operating SIEM and SOAR capabilities alongside a managed Security Operations Center.
• Ensure reliable telemetry across cloud, application, and identity environments; build and tune detections for account compromise, privilege escalation, suspicious cloud activity, and data exfiltration; and establish 24/7 monitoring and escalation processes.
• Develop incident response playbooks and automate enrichment, triage, and repeatable response actions.
• Lead technical investigations with Engineering, IT, and external providers; establish approval gates for disruptive actions; exercise response plans; and apply lessons learned to improve response.
• Deploy and operate a CNAPP across in-scope cloud assets, workloads, containers, and code repositories.
• Prioritize security findings using exploitability, exposure, asset criticality, and attack-path context, and consolidate cloud, code, dependency, secrets, and independent testing findings into an actionable remediation workflow.
• Partner with Engineering to assign remediation owners, set deadlines, verify fixes, manage remediation SLAs, and escalate overdue risks.
• Coordinate urgent mitigations for actively exploited vulnerabilities, maintain time-bound risk exceptions approved by the CISO, and address recurring root causes through secure defaults and automation.
• Plan penetration tests with qualified external providers and evaluate AI-powered agentic penetration testing with explicit authorization, controlled scope, human oversight, and appropriate data safeguards.
• Partner with Engineering to improve cloud IAM, secrets management, network exposure, encryption, logging, and secure configuration, including production WAF controls.
• Embed code, dependency, container, and secrets checks into CI/CD and infrastructure-as-code workflows; establish risk-based release gates; and contribute to threat modeling and security reviews for significant architecture changes, integrations, AI use cases, and customer deployments.
• Maintain security runbooks, coverage inventories, and evidence of operational controls in partnership with the CISO and GRC.
• Support ISO 27001, SOC 2, enterprise customer assurance, and future US regulated deployments through appropriate logging, access controls, vulnerability remediation, incident coordination, and controlled releases.
• Maintain defined data and access boundaries, keeping regulated customer data out of unauthorized tools and environments.

Benefits

• Meaningful equity.
• Competitive salary benchmarked to your market.
• Flexible, hybrid work model.
• Health coverage.
• Dental coverage.
• Vision coverage.
• Opportunity to work with some of the world's most complex and fascinating manufacturing operations.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed