Security Operations Team Lead

Cyera•New York, NY

2d•$150,000 - $225,000

About The Position

Cyera is hiring a Security Operations Team Lead to lead a team of Security Operations Engineers and own the day-to-day health and improvement of its agentic SOC. The role serves as incident commander for major incidents and leads the customer zero program, operating the Cyera platform in the company’s own environment and sharing findings with Product. It is a player-coach position combining team leadership with hands-on security operations work.

Requirements

Five or more years of experience in security operations, incident response, or detection engineering, including senior- or lead-level work.
Experience running significant incidents end to end, including executive communication.
Experience leading, mentoring, or managing engineers or analysts.
Hands-on experience running AI-assisted and agent-based security workflows, with the ability to assess agent reliability and failure modes and measure both.
Strong knowledge of AWS security architecture, IAM, logging, and cloud incident response.
AWS Security Specialty or Solutions Architect Associate certification, or equivalent demonstrated depth.
Strong Python skills and detection engineering experience across SIEM and cloud telemetry; able to review and improve others’ work.
Experience defining metrics, running an operational cadence, and reporting to leadership.
Clear communication with executives and engineers, and the ability to remain calm and decisive under pressure.

Nice To Haves

Experience with DSPM, DLP, or operating a security product as an internal customer.
Experience in regulated environments, including FedRAMP, SOC 2, or ISO 27001.
Certifications such as GCIH, GCFA, CISSP, AWS Security Specialty, or similar.

Responsibilities

Lead, coach, and develop the Security Operations team; set priorities, run the operational cadence, and build career paths.
Direct responses to major incidents, make containment decisions, manage stakeholder communications, and own the after-action process.
Own the agentic SOC’s metrics and roadmap and prioritize improvements.
Manage the security-agent fleet, including defining guardrails and human approval points, evaluating accuracy, maintaining an audit trail, and reporting impact on autonomous handling and analyst capacity.
Own posture goals, remediation governance, product feedback, and reporting for the internal Cyera deployment in the customer zero program.
Set detection and response priorities with the Security Engineering lead based on the threat model and coverage.
Design and run on-call and coverage arrangements, including external or follow-the-sun support as needed.
Handle the hardest investigations, build detections and playbooks, and write code, using AI-assisted workflows as the default way of working.
Represent Security Operations to security leadership and R&D, translating operational data into risk and status.