Director, Security Operations

Acrisure; Grand Rapids (MI); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Comprehensive medical, dental, and vis

Life and disability insurance

Wellness resources and paid time off

401(k) with employer match

Job summary

Acrisure is seeking a Director of Security Operations to lead enterprise security operations, incident response, threat hunting, and platform optimization. This on-site role requires building scalable operating models, mentoring managers and engineers, and driving automation to reduce risk across a global footprint.

The role emphasizes execution, operational excellence, and rapid detection and response, with collaboration across Legal, Privacy, HR, and Technology to align outcomes with business

Qualifications

• Bachelor's degree in Cybersecurity, IT, Computer Science, or related field.
• 10+ years of progressive cybersecurity experience.
• 5+ years leading Security Operations, Incident Response, Threat Hunting, SOC, or Cyber Defense teams.
• Experience managing enterprise security operations in complex, hybrid cloud environments.
• Deep understanding of incident response methodologies, threat detection, cyber defense operations, and security monitoring practices.
• Experience with enterprise security platforms including Microsoft Defender, Sentinel, SentinelOne, Google SecOps, Splunk, CrowdStrike, Palo Alto, or comparable technologies.
• Strong leadership, communication, and stakeholder management skills.
• Experience managing operational metrics, budgets, vendors, and service providers.

Responsibilities

• Lead security operations teams responsible for security monitoring, alert triage, incident response, threat hunting, and cyber defense activities.
• Establish operational priorities and execution plans aligned with risk reduction objectives.
• Build scalable operating models for detection, investigation, and response across a global environment.
• Ensure consistent operational processes, documentation, escalation procedures, and service delivery standards.
• Develop and mentor managers, engineers, and analysts while fostering accountability and continuous improvement.
• Oversee enterprise detection and response across endpoints, identity, cloud, network, email, and apps.
• Lead operational readiness programs including playbooks, runbooks, tabletop exercises, simulations, and incident reviews.
• Drive improvements to detection coverage and response effectiveness based on threats and intelligence.
• Coordinate with Legal, Privacy, HR, Compliance, Internal Audit, and Technology during incidents.
• Lead post-incident reviews and ensure regulatory and reporting requirements are met.

Skills

Leadership

Communication

Stakeholder management

Cybersecurity expertise

Incident response

Threat detection

Security monitoring

Team leadership

Education

Bachelor's degree in Cybersecurity, IT, CS

Tools

Microsoft Defender

Microsoft Sentinel

SentinelOne

Google Cloud Security

Splunk

CrowdStrike

Palo Alto

Job description

About Acrisure

A global fintech leader, Acrisure empowers millions of ambitious businesses and individuals with the right solutions to grow boldly forward. By bringing cutting-edge technology and top-tier human support together, we connect clients with customized solutions across insurance, reinsurance, payroll, benefits, cybersecurity, mortgage services — and more.

In the last twelve years, Acrisure has grown in revenue from $38 million to nearly $5 billion, with over 19,000 colleagues in more than 20 countries. Acrisure was built on entrepreneurial spirit. Prioritizing leadership, accountability, and collaboration, we equip our teams to work at the highest levels possible.

Job Summary

The Director, Security Operations leads the day-to-day execution and delivery of enterprise security operations capabilities, including threat detection, incident response, threat hunting, security monitoring, operational security platforms, and cyber defense processes. This role is accountable for managing teams responsible for detecting, investigating, containing, and responding to cybersecurity threats while continuously improving operational effectiveness through automation, process maturity, and technology optimization.

This is an execution-focused leadership role. Success is measured by operational excellence, rapid detection and response, platform reliability, measurable risk reduction, and strong partnership with Technology, Engineering, Legal, Privacy, Human Resources, and business stakeholders. The role does not own enterprise cybersecurity strategy but is responsible for translating strategy into operational outcomes.

Success in this role means building a highly effective security operations program that rapidly detects and responds to threats, continuously reduces operational risk, and enables the business to operate securely at scale. The Director establishes disciplined execution, operational reliability, and strong cross-functional partnerships while creating a culture of accountability, automation, and continuous improvement across the security operations organization.

Responsibilities

Security Operations Leadership

• Lead security operations teams responsible for security monitoring, alert triage, incident response, threat hunting, and cyber defense activities.
• Establish operational priorities and execution plans aligned with organizational risk reduction objectives.
• Build scalable operating models that enable efficient detection, investigation, and response across a global environment.
• Ensure consistent operational processes, documentation, escalation procedures, and service delivery standards.
• Develop and mentor managers, engineers, and analysts while fostering accountability, ownership, and continuous improvement.

Threat Detection & Response

• Oversee enterprise detection and response capabilities across endpoint, identity, cloud, network, email, and application environments.
• Ensure timely identification, investigation, containment, eradication, and recovery of cybersecurity incidents.
• Act as a senior escalation point for major incidents and provide executive-level situational updates when required.
• Lead operational readiness programs including playbooks, runbooks, tabletop exercises, simulations, and incident reviews.
• Drive improvements to detection coverage and response effectiveness based on emerging threats, incidents, and intelligence.

Threat Hunting & Cyber Defense

• Lead proactive threat hunting initiatives across enterprise environments.
• Ensure threat intelligence is operationalized into detection content, hunting activities, and response procedures.
• Drive maturity around adversary-focused operations utilizing frameworks such as MITRE ATT&CK.
• Partner with Engineering and Infrastructure teams to address security weaknesses identified through operational activities.

Security Platforms & Operational Engineering

• Own operational effectiveness of security technologies including SIEM, SOAR, EDR/XDR, threat intelligence, email security, cloud security, and related security operations tooling.
• Drive automation initiatives that improve analyst efficiency, reduce response times, and minimize repetitive manual work.
• Partner with Security Engineering teams to improve telemetry, integrations, detections, and platform reliability.
• Ensure operational tooling remains scalable and aligned to business growth and acquisition activities.

Incident Management & Cross-Functional Coordination

• Coordinate with Legal, Privacy, Human Resources, Compliance, Internal Audit, and Technology teams during security incidents.
• Establish communication models and escalation paths for major cyber events.
• Lead post-incident reviews to identify root causes, lessons learned, and corrective actions.
• Ensure operational activities support regulatory, contractual, and reporting requirements.

Metrics, Reporting & Continuous Improvement

• Define and maintain meaningful operational metrics and key performance indicators including:
• Mean Time to Detect (MTTD)
• Mean Time to Respond (MTTR)
• Detection Coverage
• Incident Severity Trends
• Alert Fidelity
• Automation Adoption
• Threat Hunting Effectiveness
• Provide regular operational reporting to cybersecurity leadership and executive stakeholders.
• Drive disciplined continuous improvement efforts focused on increasing resilience and reducing organizational risk.

Minimum Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field.
• 10+ years of progressive cybersecurity experience.
• 5+ years leading Security Operations, Incident Response, Threat Hunting, SOC, or Cyber Defense teams.
• Experience managing enterprise security operations in complex, hybrid cloud environments.
• Deep understanding of incident response methodologies, threat detection, cyber defense operations, and security monitoring practices.
• Experience with one or more enterprise security platforms including Microsoft Defender, Sentinel, SentinelOne, Google SecOps, Splunk, CrowdStrike, Palo Alto, or comparable technologies.
• Strong leadership, communication, and stakeholder management skills.
• Experience managing operational metrics, budgets, vendors, and service providers.

Preferred Qualifications

• CISSP, GIAC, GCIH, GCFA, GCIA, CISM, or equivalent certifications.
• Experience supporting cybersecurity operations for highly acquisitive or global organizations.
• Experience with Microsoft Security E5 capabilities, Microsoft Defender XDR, Microsoft Sentinel, Purview, and Azure security technologies.
• Experience implementing security automation and orchestration programs.
• Familiarity with regulatory frameworks including NIST CSF, NIST 800-61, ISO 2701, NYDFS, SOX, and industry security best practices.
• Experience leading ransomware, insider risk, cloud compromise, and business email compromise investigations.

Candidates should be comfortable with an on-site presence to support collaboration, team leadership, and cross-functional partnership.

Why Join Us

At Acrisure, we’re building more than a business, we’re building a community where people can grow, thrive, and make an impact. Our benefits are designed to support every dimension of your life, from your health and finances to your family and future.

Making a lasting impact on the communities it serves, Acrisure has pledged more than $22 million through its partnerships with Corewell Health Helen DeVos Children’s Hospital in Grand Rapids, Michigan, UPMC Children’s Hospital in Pittsburgh, Pennsylvania and Blythedale Children’s Hospital in Valhalla, New York.

Employee Benefits

• Physical Wellness: Comprehensive medical insurance, dental insurance, and vision insurance; life and disability insurance; fertility benefits; wellness resources; and paid sick time.
• Mental Wellness: Generous paid time off and holidays; Employee Assistance Program (EAP); and a complimentary Calm app subscription.
• Financial Wellness: Immediate vesting in a 401(k) plan; Health Savings Account (HSA) and Flexible Spending Account (FSA) options; commuter benefits; and employee discount programs.
• Family Care: Paid maternity leave and paid paternity leave (including for adoptive parents); legal plan options; and pet insurance coverage.
• … and so much more!

This list is not exhaustive of all available benefits. Eligibility and waiting periods may apply to certain offerings. Benefits may vary based on subsidiary entity and geographic location.

Acrisure is an Equal Opportunity Employer. We consider qualified applicants without regard to race, color, religion, sex, national origin, disability, or protected veteran status. Applicants may request reasonable accommodation by contacting [e-mail].

Final candidates will be required to complete post-offer verification processes related to the role and in accordance with applicable laws.

California Residents

Learn more about our privacy practices for applicants by visiting the Acrisure California Applicant Privacy Policy.