Sr. Manager, Security Operations

SiTime Corporation•Santa Clara, CA

7d•$154,710 - $221,230

About The Position

Reporting to the CISO, the Sr. Manager, Security Operations leads the detect-and-respond function within SiTime’s Security Organization. The role owns detection and monitoring, the 24x7 managed detection and response relationship, threat hunting, incident response, and ransomware readiness. It is a build role focused on maturing and scaling SIEM and log coverage, selecting and operating an MDR partner, developing threat-relevant detection use cases, and taking incident response and ransomware playbooks from draft to rehearsed. The position partners closely with Security Engineering and Vulnerability Management to develop detection and response platform capabilities and enrich telemetry with context such as asset criticality, ownership, identity, and vulnerability exposure. The leader begins hands-on and scales the function through full-time hires, managed service capacity, and specialist contractors. This accountable owner role is responsible for detecting, triaging, containing, and recovering from security threats, and maintaining readiness to respond at any hour. The role works with IT, Engineering, Legal, and the business, as well as Security Assurance and Security Architecture. Security Assurance includes Security Engineering, Vulnerability Management, and Offensive Security; Security Architecture establishes the logging, monitoring, and data protection architecture that supports detection coverage.

Requirements

At least 8 years of experience in security operations, detection and response, or vulnerability management, including at least 3 years building or substantially rebuilding a function.
Bachelor’s degree in Computer Science, Information Security, Engineering, or a related technical field, or equivalent practical experience.
At least one of the following certifications: CISSP, GCIA, GCIH, GCFA, or equivalent.
People leadership experience.
Hands-on experience deploying and operating a modern SIEM, including log onboarding, detection engineering, and cost control.
Experience managing an MDR or MSSP relationship, including service-level definition, escalation design, and quality review.
Demonstrated ownership of a risk-based vulnerability management program with enforced remediation service levels.
Experience leading security incidents end to end, including ransomware scenarios, and designing and running tabletop exercises.
Experience running threat hunting and mapping detection coverage to MITRE ATT&CK and ATLAS.
Technical fluency across cloud platforms such as Azure and AWS, and endpoint, network, and identity telemetry.
English proficiency sufficient to communicate, collaborate, and perform job responsibilities in a professional business environment.

Nice To Haves

Experience in a semiconductor, hardware, or other fabless/manufacturing environment, or another regulated hardware/OT-adjacent industry.
Hands-on experience with industry-leading security tools and scanners.
Experience monitoring engineering, design, and laboratory environments, including intellectual property exfiltration scenarios.
Hands-on experience with Microsoft Sentinel.

Responsibilities

Own the SIEM end to end, including design, deployment, priority log onboarding, detection content, tuning, and ongoing cost management.
Establish and enforce a log coverage standard across cloud, SaaS, endpoint, network, application, and laboratory environments, and close coverage gaps.
Manage the 24x7 MDR provider, including service levels, escalation paths, quality reviews, and operating cadence.
Build detection use cases for threats relevant to a fabless semiconductor company, including unauthorized access to and bulk movement of design data and source code.
Establish alert triage, case management, and hand-off workflows between the MDR provider and SiTime Security; measure and reduce time to acknowledge and time to contain.
Set log-retention standards that support forensic investigations, legal holds, and customer or regulatory inquiries.
Partner with Security Engineering on the coverage, configuration health, and alert quality of CrowdStrike, Darktrace, Microsoft Defender, and future sensors.
Run a threat-hunting program, directly and through the MDR provider, focused on adversary tradecraft targeting semiconductor, hardware, and intellectual property.
Track relevant threat intelligence, including state-linked activity, and translate it into detection content and hunting hypotheses.
Map detection coverage to MITRE ATT&CK and MITRE ATLAS for AI systems and agents, and address the highest-risk gaps first.
Participate in purple team exercises with Offensive Security and turn missed techniques into tested detections.
Provide exploitation and threat signals to Vulnerability Management, and partner on vulnerability response playbooks and tabletop exercises for critical vulnerabilities and zero-days.
Produce detection and response metrics that demonstrate risk reduction rather than alert volume.
Design and operate a risk-based vulnerability management program across endpoints, servers, cloud workloads, SaaS, network devices, and laboratory systems.
Define remediation service levels based on severity and asset criticality, and drive remediation with IT, Engineering, and system owners.
Own attack-surface and external-exposure monitoring of internet-facing assets and reduce the exposed footprint over time.
Operate exception handling with risk-based approval, compensating controls, and time-boxed expiry in partnership with Security Risk, Assurance and Trust.
Produce vulnerability, coverage, and aging metrics that demonstrate risk reduction rather than scan activity.
Feed vulnerability and exposure signals into the enterprise risk register to inform company-wide prioritization.
Own and maintain approved, socialized, and exercised incident response and ransomware playbooks.
Deploy and operate paging, the on-call rotation, and escalation processes, ensuring a person is reachable at any hour.
Manage the external incident response and digital forensics retainer and keep the partner current on the SiTime environment.
Plan and run ransomware and crisis tabletop exercises for executive and technical audiences, and track resulting actions to closure with evidence.
Act as incident commander for security incidents, including running the incident bridge, setting the status cadence, and producing executive reporting.
Partner with Legal, Communications, Finance, and Insurance on notification obligations, crisis communications, and claims.
Run post-incident reviews and feed findings into detection content, controls, and the security roadmap.
Scale the function through a mix of full-time hires, managed service capacity, and specialist contractors.