The Role

We are currently seeking a Sr. Manager, Security Operations to lead our Global Security Operations team within Addepar’s Information Security & Risk organization. In this role, you will own the day-to-day running of our detection and response function, act as incident commander for security incidents, and partner with our 24/7 MSSP to ensure threats are identified and handled quickly. You will set the operational objectives and strategy for Security Operations, lead and grow a global team, and shape our detection strategy for threats specific to Addepar’s environment. Beyond the immediate response, you will make sure we learn from every incident by driving post-incident follow-through, turning incident trends into lasting fixes with partners across the business, and reporting on the health of the program to Security leadership. We also want this leader to modernize how Security Operations works, applying AI and automation (AIOps) to speed up triage, investigation and response so the team can focus on the highest-impact work. The successful candidate is a hands-on leader who brings structure, calm and accountability to high-pressure situations.

Applicants must be legally authorized to work in the United States for any employer without requiring current or future visa sponsorship (for example, employment-based visas such as H-1B, F-1/OPT, or similar), and must be authorized to begin work in the U.S. on their first day of employment.

Ability to work core business hours in Eastern Time (9:00 AM – 5:00 PM ET) if working remotely.

What You’ll Do

• Operational Leadership: Lead the day-to-day operations of Addepar’s Global Security Operations team, and serve as incident commander for major security incidents
• People Management: Manage and develop a globally distributed team. Provide mentorship and training, set the team’s roadmap and OKRs, and manage on-call coverage across time zones
• MSSP Partnership: Own the relationship with our 24/7 Managed Security Services Provider (MSSP), including escalation paths, service quality, vendor performance and cost, and handoffs to the internal team
• Detection & SIEM: Own our detection strategy and the health of our SIEM environment. This includes building custom detections for threats unique to Addepar, tuning alerts to improve fidelity and reduce noise, expanding log source coverage, and ensuring the platform scales as Addepar grows
• AI-Driven Modernization: Lead the modernization of our SecOps function through AIOps, using AI and automation to streamline alert triage, enrichment, investigation and response, reduce manual toil, and scale the team’s impact
• Documentation & Playbooks: Build and own our incident response documentation, including playbooks, runbooks and training materials, and keep it current as threats and our environment evolve
• Post-Incident Accountability: Maintain our post-incident process so action items are clearly owned, tracked and closed across teams, covering both immediate fixes and longer-term improvements
• Root Cause Remediation: Use incident trends to identify recurring root causes, and partner with Engineering, Infrastructure, Security and Product teams to prioritize and deliver preventive fixes
• Metrics, KPIs & Reporting: Define and track key SecOps metrics and KPIs, and present a holistic monthly view of the Security Operations function to senior leadership
• Security Awareness: Champion security awareness across the company through tabletop exercises, training sessions and talks
• On-Call: Participate in a global on-call rotation, including responding to critical security events outside of standard working hours

Who You Are

• You have 8+ years of experience in security operations, detection engineering, or incident response
• Ability to work core business hours in Eastern Time (9:00 AM – 5:00 PM ET) if working remotely.
• You have 3+ years of people management experience, with a track record of mentoring and developing security teams
• You have proven experience as an incident commander for security incidents: leading the response, coordinating multiple workstreams, running postmortems and driving action items to completion
• You have hands-on experience with Amazon Web Services (AWS), including investigating and responding to security events in the cloud
• You hold a Bachelor’s degree in Computer Science, Cyber Security, or a related field, or have equivalent experience
• You communicate clearly with technical and non-technical audiences, including senior leadership, and can influence peers and leaders to build agreement in sensitive situations
• You bring structure to ambiguous, fast-moving situations and stay composed under pressure