Security Operations Team Lead

Cyera•New York, NY

About The Position

Cyera is hiring a Security Operations Team Lead to lead its Security Operations Engineers and maintain and improve its agentic security operations center (SOC). This is a hands-on player-coach role that includes serving as incident commander for major incidents and owning Cyera’s “customer zero” program, which operates the Cyera platform in the company’s own environment and feeds findings back to Product. The role requires security operations or incident response experience, including senior or lead-level work, experience handling significant incidents end to end, and experience leading or mentoring engineers.

Requirements

At least 5 years of experience in security operations, incident response, or detection engineering, including senior- or lead-level work.
Experience running significant incidents end to end, including executive communication.
Experience leading, mentoring, or managing engineers or analysts.
Hands-on experience running AI-assisted and agent-based security workflows, with an understanding of where agents are reliable, where they fail, and how to measure both.
Strong knowledge of AWS security architecture, IAM, logging, and cloud incident response.
AWS Security Specialty or Solutions Architect Associate certification, or equivalent demonstrated depth.
Strong Python skills and detection engineering experience across SIEM and cloud telemetry; ability to review and improve others’ work.
Experience defining metrics, running an operational cadence, and reporting to leadership.
Clear communication with executives and engineers, and the ability to remain calm and decisive under pressure.

Nice To Haves

Experience with DSPM, DLP, or operating a security product as an internal customer.
Experience in regulated environments such as FedRAMP, SOC 2, or ISO 27001.
Certifications such as GCIH, GCFA, CISSP, AWS Security Specialty, or similar.

Responsibilities

Lead, coach, and develop the Security Operations team; set priorities, run the operational cadence, and build career paths.
Direct responses to major incidents, make containment decisions, manage stakeholder communications, and own the after-action process.
Own the metrics and roadmap for the agentic SOC and prioritize operational improvements.
Manage the fleet of security agents used for initial triage, investigation, and response; define guardrails and human approval points, evaluate accuracy, maintain an audit trail, and report effects on autonomous handling and analyst capacity.
Own posture goals, remediation governance, the Product feedback loop, and reporting for Cyera’s internal deployment of its platform.
Set detection and response priorities with the Security Engineering lead based on the threat model and coverage.
Design and run on-call and coverage arrangements, including any external or follow-the-sun support.
Handle the most difficult investigations, build detections and playbooks, and write code, using AI-assisted workflows as the default way of working.
Represent Security Operations to security leadership and R&D, translating operational data into risk and status.