Cyber Defense Unit Manager

Acronis, Inc.; Burlington (MA); On-site; USD 170,000 - 260,000; Full time

Benefits offered by this job

Medical Insurance

Dental Insurance

Vision Insurance

401(k) Match

Paid Time Off

Job summary

Acronis, Inc. is seeking an experienced Cyber Defense Unit Manager to lead and strengthen our global cyber defense capabilities. This role owns security operations, threat detection, incident response, threat intelligence, and proactive defense.

You will build a high-performing team and coordinate with executives across legal, compliance, and IT. The position requires hands-on leadership, strategic planning, and effective communication to protect MSPs, SMBs, and enterprise IT environments.

Qualifications

• Significant cybersecurity leadership experience (typically 10+ years).
• Minimum 5+ years directing global security operations and incident response teams.
• Proven ability to build and mature a cyber defense program.
• Strong knowledge of MITRE ATT&CK framework and modern attacker techniques.
• Experience with threat hunting and proactive defense strategies.
• Familiarity with AWS/Azure cloud security and cloud-native logging.
• Ability to manage budgets, vendors, and external partners.

Responsibilities

• Lead the Cyber Defense function with strategy, roadmaps, and operating model improvements.
• Mentor and develop a global team across time zones, including on-call models.
• Oversee 24x7 monitoring, threat detection, and incident response activities.
• Drive detection engineering across SIEM/EDR/SOAR with a focus on reducing false positives.
• Lead investigations, post-incident reviews, and regulatory coordination as needed.
• Develop and communicate metrics to executive leadership and the Board.

Skills

Leadership

Security Operations

Threat Detection

Incident Response

Threat Hunting

MITRE ATT&CK

Cloud Security

Automation/Scripting

Budget Management

Executive Communication

Tools

SIEM

EDR/XDR

SOAR

Threat Intelligence

AWS

Azure

Digital Forensics

Job description

Acronis is a global leader in cyber protection, delivering AI-powered protection for productive MSPs in a single, natively integrated platform that unifies operations management, cybersecurity, and data protection. Driven by our mission to protect, manage and automate every workload that businesses and lives depend on, we’ve built the industry’s only all-in-one solution. We are looking for an experienced Cyber Defense Unit Manager to lead and strengthen our global cyber defense capabilities. This role owns security operations, threat detection, incident response, threat intelligence, and proactive defense. You will build a high-performing team and continuously improve our ability to anticipate, detect, and respond to evolving cyber threats. The ideal candidate combines deep cybersecurity expertise, operational leadership, and people management to build a modern, intelligence-driven cyber defense function. You are comfortable operating in a fast-paced global technology environment and can move seamlessly between strategy, hands‑on operations, major incidents, and executive‑level communication.

WHAT YOU’LL DO

Strategy and Leadership

• Lead the Cyber Defense function, including strategy, roadmap, operating model, and continuous maturity improvement (e.g., against NIST CSF or SOC-CMM)
• Manage, mentor, and develop a global team of analysts, responders, threat hunters, and detection engineers, ensuring coverage across time zones, including follow-the-sun or on-call models
• Define the build-versus-buy approach for the function, including management of MDR/MSSP and other external partners, and manage the Cyber Defense budget

Security Operations, Monitoring, and Threat Hunting

• Oversee 24x7 security monitoring, alert triage, investigation, and escalation across endpoints, networks, identities, applications, and cloud environments
• Establish and maintain SOC processes, runbooks, severity definitions, and handoffs to ensure consistent, high-quality investigations
• Lead proactive, hypothesis-driven threat hunting and attack surface monitoring, including identity-based and cloud-native threats
• Run purple team and adversary emulation exercises to validate detection and response effectiveness

Detection Engineering

• Own the detection engineering lifecycle: use case development, testing, tuning, deployment, and retirement, with a focus on reducing false positives and alert fatigue
• Map detection coverage to MITRE ATT&CK, identify gaps, and prioritize improvements based on threat relevance and business risk
• Ensure telemetry completeness by defining log source requirements and onboarding priorities with IT, Cloud, and Engineering

Incident Response

• Lead response to significant cybersecurity incidents, coordinating across Security, IT, Engineering, Legal, Communications, and executive leadership
• Maintain and test incident response plans, playbooks, and crisis communication procedures, including regular tabletop exercises with senior stakeholders
• Oversee digital forensics, evidence handling, containment, eradication, and recovery, working with Legal to preserve privilege and support investigations, legal holds, and regulatory inquiries
• Support breach assessment and regulatory notification decisions with Legal and Compliance (e.g., GDPR, HIPAA, SEC disclosure, and other applicable obligations)
• Run post-incident reviews and drive corrective actions to closure.

Threat Intelligence

• Build and manage a threat intelligence capability that tracks threat actors, campaigns, and techniques relevant to Acronis, its customers, and the MSP ecosystem
• Translate intelligence into actionable detections, hunts, blocking actions, and risk-informed recommendations for leadership
• Participate in industry intelligence-sharing communities and partnerships (e.g., ISACs, peer groups, law enforcement liaison)

Technology, Automation, and AI

• Own and optimize core cyber defense technologies, including SIEM, EDR/XDR, SOAR, and threat intelligence platforms, including roadmap, integrations, and vendor performance
• Drive automation and AI-assisted capabilities to improve detection, enrichment, triage, investigation, and response, with appropriate governance and human oversight
• Leverage Acronis’ own products and platform capabilities where appropriate to strengthen internal defense

Metrics, Reporting, and Executive Communication

• Establish KPIs and reporting for cyber defense effectiveness, such as MTTD, MTTR, detection coverage, alert quality, incident trends, and threat exposure
• Report cyber defense posture, major incidents, and risk trends to senior leadership, and when needed the Board and Audit Committee

Cross-Functional Partnership

• Partner with Security leadership, IT, Cloud, Engineering, Product Security, and Legal to strengthen the company’s overall security posture
• Coordinate with Vulnerability Management and Product Security on exploitable risks, emergency patching, and threat-informed prioritization
• Support audits, customer assurance requests, and regulatory requirements related to monitoring and incident response

WHO WE’RE LOOKING FOR

• Significant cybersecurity experience (typically 10+ years) in security operations, incident response, threat detection, or cyber defense, including 5+ years leading teams
• Proven experience leading cybersecurity teams within a global technology or software environment, including distributed, multi‑time‑zone teams
• Demonstrated experience leading major incident response efforts from detection through recovery and post-incident review
• Strong understanding of modern attacker techniques, threat actor tradecraft, and frameworks such as MITRE ATT&CK
• Hands‑on knowledge of SIEM, EDR/XDR, SOAR, threat intelligence, and security monitoring technologies, including evaluation and optimization
• Experience with threat hunting and detection engineering, including detection‑as‑code practices
• Strong understanding of AWS, Azure, or other modern cloud environments, including cloud‑native logging, detection, and response
• Experience with digital forensics and investigations, and working knowledge of breach notification and regulatory requirements
• Experience leveraging automation, scripting (e.g., Python), and ideally AI within security operations
• Experience managing budgets, vendors, and managed security service providers
• Strong leadership, analytical, and decision‑making skills, particularly during high‑pressure incidents
• Ability to communicate complex cybersecurity risks clearly to technical and executive stakeholders, including legal and board audiences
• High integrity and sound judgment when handling sensitive, confidential, and privileged information
• Relevant certifications such as CISSP, CISM, GIAC (GCIH, GCFA, GCTI, GCDA), or OSCP are a plus

WHO WE ARE

A Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 21,000 service providers to protect more than 750,000 businesses. Our corporate culture centers on innovation, accountability, and impact. We encourage our people to think boldly, challenge conventional approaches, and take ownership of outcomes. As a member of our global “A-Team,” you’ll operate in a high-growth, fast-paced environment where resilience, adaptability, and a commitment to continuous improvement drive success.

OUR INTERVIEW PRACTICES

To maintain a fair and genuine hiring process, we kindly ask that all candidates participate in interviews without the assistance of AI tools or external prompts. Our interview process is designed to assess your individual skills, experiences, and communication style. We value authenticity and want to ensure we’re getting to know you—not a digital assistant. To help maintain this integrity, we ask to remove virtual backgrounds and include in-person interviews in our hiring process. Use of AI-generated responses or third-party support during live interviews may be grounds for disqualification from the recruitment process and a full criminal, education and identification background check is required for all new hires.

Acronis is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, color, marital status, national origin, physical or mental disability, medical condition, protected veteran status, race, religion, sex (including pregnancy), sexual orientation, gender identity or expression, or any other characteristic protected by applicable laws, regulations and ordinances.

The US pay range for this position is $170,000–$260,000. This range reflects the minimum and maximum total target annual compensation for this role across all U.S. locations. The actual compensation offered at the start of employment is determined based on factors including, but not limited to, experience level, knowledge, skills, and geographic location.

In addition to competitive compensation, this role includes a comprehensive benefits package featuring medical, dental, and vision coverage, flexible spending accounts (FSA), disability and life insurance, a 401(k) retirement plan with company match, and a generous vacation policy.

Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), enterprise IT departments and home users. Our all-in-one solutions are highly efficient and designed to identify, prevent, detect, respond, remediate, and recover from modern cyberthreats with minimal downtime, ensuring data integrity and business continuity. We offer the most comprehensive security solution on the market for MSPs with our unique ability to meet the needs of diverse and distributed IT environments. A Swiss company founded in Singapore in 2003, Acronis offers over twenty years of innovation with 15 offices worldwide and more than 1800 employees in 50+ countries. Acronis Cyber Protect is available in 26 languages in 150 countries and is used by over 20,000 service providers to protect over 750,000 businesses. Our corporate culture is focused on making a positive impact on the lives of each employee and the communities we serve. Mutual trust, respect and belief that we can contribute to the world everyday are the cornerstones of our team. Each member of our “A-Team” plays an instrumental role in driving the success of our innovative and expanding business. We seek individuals who excel in dynamic, global environments and have a never give up attitude, contributing to our collective growth and impact.