Security Operations Team Lead

About the role

Safe Software is creating a new Security Operations function and needs a leader to build and run it. Reporting to the Director of Information Security, you will own incident response, vulnerability management, system hardening, device trust, and resiliency planning while managing a growing team of Security Operations Engineers.

Key responsibilities

• Build and lead the security operations team – hiring, onboarding, coaching, performance management, and career development.
• Own the end‑to‑end incident response program, including processes, runbooks, on‑call rotation, tabletop exercises and post‑incident reviews.
• Define and execute the security operations roadmap, translating strategy into prioritized work with clear outcomes.
• Drive maturity of automated patch management, CIS benchmark hardening, device trust, conditional access, vulnerability management SLAs and resiliency planning.
• Set technical direction for tooling such as Rapid7 InsightVM, InsightIDR, Cisco Secure Endpoint, Cisco Umbrella, Active Directory, JumpCloud, Google Workspace and AWS security controls.
• Define, track and act on metrics like detection/response times, remediation SLAs, patch coverage and alert quality.
• Champion AI and automation in workflows while establishing safe guardrails.
• Ensure compliance evidence for ISO 27001, SOC 2 and future frameworks.

Required profile

• 5+ years in security operations or related engineering, with 1–2 years leading a team.
• Proven ownership of a security program (incident response, vulnerability management, hardening) from immature to reliable operation.
• Strong incident response experience, including leading major incidents and maintaining realistic runbooks.
• Hands‑on SIEM and EDR experience, building detections and improving signal‑to‑noise.
• Practical experience with vulnerability and patch management at scale and CIS benchmark hardening.
• Solid network and cloud security knowledge, especially AWS IAM, logging, network controls and Google Workspace administration.
• Experience with identity and access controls (SSO, MFA, conditional access, device trust).
• Familiarity with ISO 27001, SOC 2 compliance processes.

Required skills

• Rapid7 InsightVM (vulnerability management) and InsightIDR (SIEM).
• Cisco Secure Endpoint (EDR) and Cisco Umbrella.
• Active Directory, JumpCloud, Google Workspace administration.
• AWS security services (IAM, logging, network controls).
• Python or PowerShell scripting for automation.
• MITRE ATT&CK framework.
• CIS Benchmarks for system hardening.