Note: The job is a remote job and is open to candidates in USA. National Debt Relief is hiring a Director of Security Operations to lead enterprise detection and response. The role owns incident response, endpoint and email security, SIEM and detection engineering, and the team’s strategy, staffing, budget, and operational metrics while remaining hands-on during incidents and in detection work.

Responsibilities

• Own the detection and response strategy and multi year roadmap, and align it to enterprise risk, the threat landscape, and business priorities
• Lead, coach, and develop the security operations team, including hiring, scheduling, on call rotation, performance management, succession planning, and career development
• Operate as a player coach, taking incident commander duty, writing detections, and performing hands on analysis alongside the team
• Own the incident response program end to end, including the IR plan, severity model, escalation paths, tabletop exercises, evidence handling, and post incident review
• Own endpoint detection and response strategy and operations, including policy tuning, coverage assurance, containment workflows, and threat hunting
• Own email security, including phishing defense, mail authentication controls (SPF, DKIM, DMARC), user reporting workflows, and response to business email compromise attempts
• Own SIEM and detection engineering, including log source onboarding, detection development and testing, alert quality, and false positive reduction
• Build and maintain automation and runbooks that shorten response time and remove repetitive analyst work
• Develop threat informed detection coverage mapped to MITRE ATT&CK and validate it through purple team and control testing
• Define and report operational metrics including mean time to detect, mean time to respond, alert volume and quality, coverage, and containment effectiveness
• Coordinate with IT, engineering, legal, privacy, and communications during incidents, including support for regulatory and customer notification decisions
• Own budget, staffing plan, and vendor strategy for the detection and response stack, including managed service providers, tooling selection, and licensing
• Present program status, incident outcomes, and risk decisions to executive leadership, and support board, audit committee, and regulator reporting as requested
• Support audit and compliance requirements with evidence for monitoring, response, and control operation

Skills

• 10 years of information security experience, including 5 years focused on security operations, incident response, or detection engineering, required
• 5 years of direct people leadership experience, including hiring, performance management, and on call ownership, required
• Experience owning a function level budget, vendor relationships, and a staffing plan, required
• Bachelor's degree in information systems, computer science, or a related field, or equivalent practical experience
• Hands on operational experience with SIEM platforms, including query authoring, data modeling, and detection development
• Hands on experience with EDR platforms, including policy design, containment actions, and threat hunting
• Experience operating email security controls and phishing response at scale
• Working knowledge of attacker tradecraft including initial access, persistence, privilege escalation, lateral movement, and exfiltration
• Practical use of MITRE ATT&CK for coverage assessment and detection planning
• Incident response and forensic practice, including host and cloud artifact analysis, chain of custody, and timeline construction
• Cloud detection and response experience in AWS, Azure, or GCP, including identity provider telemetry such as Okta or Entra ID
• Scripting and automation ability (Python, PowerShell, or similar) for enrichment, response actions, and SOAR workflows
• Strong knowledge of TCP/IP, DNS, HTTP, and operating system internals for Windows and macOS
• Knowledge of secure configuration management and endpoint security technologies across multiple platforms
• Understanding of compliance areas including controls for SOC 2, PCI DSS, and applicable state privacy and breach notification requirements
• Ability to remain calm and decisive during active incidents and to communicate status clearly to technical and executive audiences
• Strong verbal and written communication, including the ability to translate technical risk into business terms for non technical stakeholders
• Proven ability to build rapport and durable working relationships with business, IT, and engineering leaders
• Ability to influence without direct authority and to position security as a pragmatic, value added partner rather than a control function
• Strong documentation and communication skills
• Curious, inquisitive, innovative, lifelong learner and self-starter
• Able to effectively give, receive, and respond to feedback
• Computer competency and ability to work with a computer
• Prioritize multiple tasks and projects simultaneously
• Exceptional written and verbal communication skills
• Remain calm and professional during difficult discussions
• Take constructive feedback
• Industry recognized certification(s) highly recommended: GCIH, GCIA, GCFA, CISSP, or CISM

Benefits

• Generous Medical, Dental, and Vision Benefits
• 401(k) with Company Match
• Paid Holidays, Volunteer Time Off, Sick Days, and Vacation
• 12 weeks Paid Parental Leave
• Pre-tax Transit Benefits
• No-Cost Life Insurance Benefits
• Voluntary Benefits Options
• ASPCA Pet Health Insurance Discount
• Wellness Incentive Program
• Employee mentorship and leadership programs

Company Overview

Company H1B Sponsorship