The Director, Cybersecurity Operations leads Security Operations and Incident Response, Security Engineering, Vulnerability Management, and Threat Intelligence. This is a player-coach leadership role reporting directly to the CISO, partnering with the Director, Cyber GRC as one unified cyber team. The Director will bring hands-on technical depth, strong leadership capability, and the ability to modernize security operations through MDR deployment, AI-informed detection, and a security engineering team organized around functional specialization.Key responsibilitiesOwn the MDR relationship, including SLA management, escalation accountability, detection tuning, and quarterly threat hunt reviewsLead the incident response function: IR runbooks, major incident coordination, executive communication during active incidents, and post-incident root cause analysisOversee SOC detection engineering, ensuring SIEM rules, SOAR playbooks, and automated response actions are maintained, tested, and tuned to the current threat landscapeDirect and develop the security analyst pool, redeploying analyst capacity from frontline triage toward MDR validation, threat hunt support, and stakeholder reportingOversee four specialized engineering lanes [endpoint, identity, cloud, and application security], ensuring each lane has clear ownership, defined scope, and measurable outcomesDrive security architecture reviews and engineering decisions for large or complex IT projects, ensuring security requirements are built in rather than bolted onShape the security tooling stack strategy, evaluating, selecting, and retiring tools across endpoint, identity, cloud, and application securityEnforce automation-first engineering practices, including IaC security gates, CI/CD pipeline security, CSPM auto-remediation, and SOAR-driven response workflowsLead the operationalization of threat intelligence, translating MDR findings and external threat data into detection rule updates, architecture decisions, and risk register inputs for the GRC teamOwn the vulnerability management lifecycle: scanning coverage, risk-based prioritization, remediation tracking, and SLA enforcementOwn the purple team and control validation program, confirming that deployed controls operate as intended and that detection capabilities fire correctly against known attack techniquesDrive threat modeling across the engineering function, identifying attack paths before they are exploited and feeding findings into remediation prioritizationOversee the AppSec function: secure SDLC, code review gates, SAST/DAST tooling, and security collaboration with the Product and Engineering teamsOwn cloud security posture management: CSPM, cloud workload protection, cloud IAM governance, and cloud-native security architectureSet the team-wide AI security posture, overseeing AI security controls across all engineering lanes, including model security, prompt injection testing, and AI tool access governance in partnership with cyber leadershipLead the ongoing maturation of the MDR deployment, expanding coverage, improving response fidelity, and integrating MDR outputs with internal SIEM, IAM, and compliance evidence workflowsChampion security automation across the team, reducing manual toil in detection, response, vulnerability tracking, and reporting through SOAR, scripting, and platform integrationsEvaluate emerging security technologies and make build/buy/partner recommendations to the CISO with clear business and risk rationaleLead, develop, and performance-manage a lean engineering teamPartner with the Director, Cyber GRC as one unified cyber function, feeding operational threat intelligence into the risk register, supporting compliance evidence for technical controls, and jointly presenting security postureProvide regular metrics and reporting to the CISO on incident trends, control coverage, MDR performance, vulnerability posture, and team developmentBuild a team culture of continuous improvement, automation-first execution, and proactive security, where threat hunting and control validation are protected activities rather than aspirational onesQualificationsExperience15+ years of progressive experience in information security, including at least 7 years in a security leadership roleDemonstrated ownership of a security operations or engineering function at the Director or equivalent levelExperience operating and maturing an MDR deployment (CrowdStrike Falcon Complete, Arctic Wolf, Expel, or equivalent) in a corporate environmentHands-on background in at least two of the following: security engineering, penetration testing/offensive security, cloud security, application security, or incident response; this is not a purely strategic roleDemonstrated experience deploying or maturing security automation, such as SOAR playbooks, detection engineering, IaC security, or CI/CD pipeline securityFamiliarity with cloud-native security (AWS, Azure, or GCP), including CSPM, cloud IAM, and workload protectionTechnical knowledgeWorking knowledge of cybersecurity frameworks such as NIST SP 800-171, ISO 27001, and SOC 2Understanding of the vulnerability management lifecycle: scanning, prioritization, remediation tracking, and SLA enforcementFamiliarity with AppSec disciplines: SAST/DAST tooling, secure SDLC, and security gate integration into CI/CDUnderstanding of IAM security governance (PAM, access review programs, and SSO/MFA architecture) as distinct from IT provisioning executionExperience with AI security considerations (model testing, prompt injection, AI tool access governance, and emerging AI governance frameworks such as the NIST AI RMF and ISO 42001) is a meaningful differentiatorFoundational awareness of CMMC requirementsGeneral abilitiesAn exceptional communicator, able to translate complex cyber risk and compliance concepts into clear business language for executives, clients, and regulators alikeA natural collaborator and client-facing presence, comfortable leading enterprise client security discussions, representing KLDiscovery in due diligence meetings, and building trust with external stakeholdersBusiness-minded, balancing security requirements against commercial realities and making practical decisions without sacrificing rigorA continuous learner with genuine curiosity, energized by a fast-growing company and a rapidly evolving regulatory and threat landscapeDiscreet and trusted, exercising sound judgment, maintaining confidentiality, and operating with professionalismEducationBachelor's degree in Information Security, Computer Science, Engineering, Business, or a related field requiredProfessional certifications such as CISSP, CISM, CISA, GPEN, GCIA, or other GIAC certifications strongly preferredMaster's degree or MBA with a security focus preferredOur mission and core valuesWe bring clarity, trust, and meaning to data for clients navigating legal matters worldwide.Client is Always in the Room. We operate and make decisions as if the client is in the room. We anticipate their needs, consider their perspective, and prioritize their best interests.Better Every Day. We improve our tomorrow by always striving to be better than today. We embrace curiosity, question assumptions, and raise the bar constantly.Own the Outcome. We bring an unwavering bias for action, act with urgency, and hold ourselves accountable to our clients and each other.Deliver Results Together. We collaborate obsessively to achieve shared success. We assume good intentions, debate ideas thoughtfully, treat each other with respect, and fully commit once decisions are made.Our culture shapes our actions, our products, and the relationships we forge with our customers.
21 days ago