Manager, Defensive Cyber Operations

External

Blackbaud · Remote

Full-timeRemote1d ago

AWSAzureDocumentationIncident ResponsePythonSAFe

Cover Letter Connect

Prepare for this interview

Elite

AI-generated questions, company research, and talking points tailored to this role

About the role

We're hiring a Manager, Defensive Cyber Operations to mature, scale, and continuously iterate our agentic SOC. This is a hands-on player/coach role: you will lead a small team of engineers and analysts while personally owning critical technical outcomes across detection engineering, SOAR automation, breach and attack simulation, and insider threat. This role is ideal for a technical leader who improves existing systems, writes production‑quality detection and automation, leads investigations, and raises the operational bar through disciplined iteration.

Responsibilities

Lead and develop a small defensive operations team

Manage, mentor, and grow a small team of security engineers and analysts focused on detection, response, and automation.

Act as the primary technical escalation point for high‑severity incidents; lead investigations and response decision‑making.

Set and reinforce quality standards for investigations, detections, automation, documentation, and on‑call readiness.

Mature and iterate on an agentic SOC

Evolve and refine agentic SOC workflows that improve triage speed, consistency, and decision quality through automated enrichment, correlation, and recommended or automated response actions.

Iterate on existing SOC workflows, converting repeatable analyst effort into safe, reliable automation with clear guardrails, validation, and auditability.

Define and track operational metrics such as detection coverage, alert fidelity, automation success rates, and MTTD/MTTR improvements.

Detection engineering & threat detection operations

Own detection engineering outcomes end‑to‑end: alert logic, correlation rules, anomaly thresholds, tuning, and continuous improvement.

Mature a detection‑as‑engineering operating model, including requirements, testing, rollout, post‑deployment measurement, and documentation.

SOAR & security automation

Design, iterate on, and maintain SOAR playbooks for alert enrichment, containment, remediation, and case management.

Enhance custom automation, integrations, and enrichment logic to reduce manual analyst effort and improve response consistency.

Ensure automation remains resilient, production‑grade, well‑documented, and operationally safe at scale.

Breach & attack simulation (continuous validation)

Mature an existing breach & attack simulation capability to continuously validate detection and response effectiveness.

Translate BAS findings into prioritized detection, automation, and response improvements on a repeatable cadence.

Insider risk

Advance insider threat detection and response capabilities, including use‑case refinement, signal quality, investigation workflows, and playbooks.

Balance speed, precision, and appropriate controls while improving investigative consistency.

What we want you to have:

5+ years experience leading security operations, detection engineering, incident response, and/or security engineering teams, with direct ownership of operational outcomes.

Strong hands‑on background in intrusion analysis using SIEM/log analytics, packet captures, and investigation tooling.

Proven experience maturing SOAR automation and/or custom tooling to drive repeatable response actions.

Strong detection engineering fundamentals, including alert fidelity, correlation, and continuous tuning.

Experience operating in cloud‑first environments, with hands‑on security detection or response exposure in AWS and Azure.

Comfort operating as both technical leader and people manager in on‑call, real‑time security environments.

Manager, Defensive Cyber Operations

About the role

Responsibilities

Requirements

Benefits

Your Match

Company Intel

What employees say

Interested in this role?