Sr. Manager, Security Operations

Description

The company is a semiconductor business focused on precision timing. It uses MEMS technology, which it positions as more accurate, smaller and more resilient than quartz, and MEMS timing is in use across more than 400 applications, including AI datacenters, automated driving, industrial and humanoid robots, wearables and IoT. The company has shipped more than 4 billion devices and is a fabless semiconductor company.

This role reports to the CISO and leads Security Operations, one of three functions in the Security Organization. The function covers detection and monitoring, the 24x7 managed detection and response relationship, threat hunting, incident response and ransomware readiness.

This is a build role. You will mature and scale the SIEM and log coverage standard, choose and run the MDR partner, create detections for threats relevant to a fabless semiconductor company, and move the incident response and ransomware playbooks from draft to rehearsed.

You will work closely with Security Engineering and Vulnerability Management to strengthen the detection and response platform and to add context to logs, such as asset criticality, owner, identity and vulnerability exposure, so alerts are comprehensive and can be acted on quickly.

You start hands-on and then grow the team using full-time hires, managed service capacity and specialist contractors for surge work and testing cycles. You are accountable for outcomes, not just advising. Your core goal is to detect, triage, contain and recover from threats before they cause material harm, and to keep the company ready to respond at any hour.

You will work with IT, Engineering, Legal and the business, and with the other two Security Organization functions: Security Assurance, whose Security Engineering team deploys and maintains the sensors you monitor, whose Vulnerability Management team leads response to critical vulnerabilities and zero-days, and whose Offensive Security team tests detections through purple team exercises; and Security Architecture, which defines the logging, monitoring and data protection design that detection depends on.

Responsibilities

• Own the SIEM end to end, including design, deployment, priority log onboarding, detection content, tuning and ongoing cost management.
• Set and enforce a log coverage standard across cloud, SaaS, endpoint, network, application and laboratory environments, and close existing gaps.
• Manage the 24x7 MDR provider, including service levels, the escalation path into the company, quality reviews and the operating rhythm.
• Build detections for threats relevant to a fabless semiconductor company, including unauthorized access to and bulk movement of design data and source code.
• Set up alert triage, case management and handoff workflows between the MDR provider and the company's security team, and measure and reduce time to acknowledge and time to contain.
• Define log retention standards that support forensic investigation, legal hold and customer or regulatory inquiries.
• Work with Security Engineering on coverage, configuration health and alert quality for CrowdStrike, Darktrace, Microsoft Defender and future sensors.
• Run a threat hunting program, directly and through the MDR provider, focused on adversary techniques used against semiconductor, hardware and intellectual property targets.
• Track threat intelligence relevant to the company, including state-linked activity, and turn it into detection content and hunting hypotheses.
• Map detection coverage to MITRE ATT&CK and to MITRE ATLAS for AI systems and agents, and close the highest-risk gaps first.
• Take part in purple team exercises with Offensive Security and turn every missed technique into a tested detection.
• Share exploitation and threat signals with Vulnerability Management, and help build the vulnerability response playbook and tabletop exercises for critical vulnerabilities and zero-days.
• Report detection and response metrics that show risk reduction, not alert volume.
• Design and run a risk-based vulnerability management program across endpoints, servers, cloud workloads, SaaS, network devices and laboratory systems.
• Set remediation service levels by severity and asset criticality, and drive closure with IT, Engineering and system owners instead of reporting open counts.
• Own monitoring of attack surface and external exposure for internet-facing assets, and shrink the exposed footprint over time.
• Run exception handling with risk-based approval, compensating controls and time-limited expiry, with the Security Risk, Assurance and Trust function.
• Report vulnerability, coverage and aging metrics that show risk reduction, not scan activity.
• Feed vulnerability and exposure signals into the enterprise risk register so they inform company-wide priorities.
• Own the incident response and ransomware playbooks, and keep them approved, shared with stakeholders and regularly exercised.
• Set up paging, the on-call rotation and escalation so a real person can be reached at any hour.
• Manage the external incident response and digital forensics retainer, and keep the partner up to date on the company's environment.
• Plan and run ransomware and crisis tabletop exercises for executive and technical audiences, and track each resulting action to closure with evidence.
• Act as incident commander for security incidents, running the response bridge, setting the status cadence and producing executive reporting.
• Work with Legal, Communications, Finance and Insurance on notification obligations, crisis communications and insurance claims.
• Run post-incident reviews and feed the findings into detections, controls and the security roadmap.

Requirements

• 8+ years in security operations, detection and response, or vulnerability management, including 3+ years building or substantially rebuilding a function.
• Bachelor's degree in Computer Science, Information Security, Engineering or a related technical field, or equivalent practical experience.
• At least one of these certifications: CISSP, GCIA, GCIH, GCFA, or an equivalent.
• People leadership experience.
• Hands-on experience deploying and running a modern SIEM, including log onboarding, detection engineering and cost control. Microsoft Sentinel strongly preferred.
• Experience managing an MDR or MSSP relationship, including defining service levels, designing escalation paths and running quality reviews.
• Proven ownership of a risk-based vulnerability management program with enforced remediation service levels.
• Experience leading security incidents from start to finish, including ransomware, and designing and running tabletop exercises.
• Experience running threat hunting and mapping detection coverage to MITRE ATT&CK and ATLAS.
• Working knowledge of cloud platforms (Azure, AWS) and of endpoint, network and identity telemetry.
• Required: English proficiency sufficient to communicate effectively, collaborate and do the job in a professional business setting.
• Preferred: experience in a semiconductor, hardware or other fabless or manufacturing environment, or in another regulated hardware or OT-adjacent industry.
• Preferred: hands-on experience with leading industry security tools and scanners.
• Preferred: experience monitoring engineering, design and laboratory environments, including intellectual property exfiltration scenarios.
• Desired: strong executive presence and stakeholder management, able to explain complex security topics in business-friendly, risk-focused terms and influence decisions across functions without direct authority.
• Desired: program management discipline to run several cross-functional initiatives at once and carry them through to completion.

Conditions

Pay range is $154,710 to $221,230 USD per year.

The role is eligible for a quarterly bonus tied to innovation goals, in addition to base salary, and includes equity grants.

Benefits include a 401k plan, health and wellness coverage (medical, dental, vision and life), parental leave, legal services and time off plans.

We welcome applicants from a wide range of backgrounds and career paths who want to contribute to the company's mission.

Benefits

• Quarterly bonus tied to innovation goals.
• Equity grants.
• 401k plan.
• Medical, dental, vision and life coverage, plus health and wellness programs.
• Parental leave.
• Legal services.
• Time off plans.