Hands-On Security Operations Lead & Incident Commander

Cyera; New York (NY); On-site; USD 180,000 - 240,000; Full time

Job summary

Cyera is seeking a Security Operations Team Lead to guide a team of engineers, act as incident commander, and own the SOC's daily health and roadmap. This player-coach role blends leadership with hands-on work in detection and response.

You will run the customer zero program, define guardrails, mentor engineers, and partner with security leadership to improve detection across AWS and cloud telemetry using AI-assisted workflows.

Qualifications

• 5+ years in security operations or incident response, including senior/lead-level work.
• Experience running significant incidents end to end.
• Led or mentored engineers.
• Strong Python and detection engineering across SIEM and cloud telemetry.
• Hands-on with AI-assisted workflows and agent-based security.
• AWS Security Certification or equivalent depth in AWS security
• Clear executive communication under pressure
• Knowledge of AWS security architecture, IAM and logging
• Experience with DSPM, DLP in security environments
• Familiar with FedRAMP, SOC 2, ISO 27001
• Certifications such as GCIH, GCFA, CISSP are a plus

Responsibilities

• Lead a team of Security Operations Engineers.
• Act as incident commander for major incidents.
• Own day-to-day health and improvement of the SOC.
• Run customer zero program and feed learnings back to Product.
• Define guardrails and playbooks; ensure audit trails.
• Set detection and response priorities with leadership.
• Design on-call and coverage arrangements.
• Hands-on investigations and code work with AI-assisted workflows.

Skills

Team Leadership

Incident Command

Detection Engineering

Python

SIEM

Cloud telemetry

AI-assisted workflows

Executive communication

Stakeholder Management

DSPM / DLP

Regulated environments

Cloud security

Education

AWS Certification (Security Specialty)

5+ years in security operations

FedRAMP / SOC 2 / ISO 27001

CISSP / GCFA / GCIH

Job description

Cyera is seeking a Security Operations Team Lead to guide a team of engineers, act as incident commander, and own the SOC's daily health and roadmap. This player-coach role blends leadership with hands-on work in detection and response.

You will run the customer zero program, define guardrails, mentor engineers, and partner with security leadership to improve detection across AWS and cloud telemetry using AI-assisted workflows.