Manager, Adversary Intelligence

SailPoint; United States; Remote; USD 124,000 - 209,000; Full time

Benefits offered by this job

Health and wellness coverage

Disability coverage

Life insurance

401(k) Savings and Investment Plan

Paid time off & holidays

Parental leave

Employee Assistance Program

Equity eligibility

Job summary

SailPoint’s Cybersecurity organization seeks an Adversary Intelligence Manager to unify Red Team and CTI functions, elevating offense and intelligence capabilities. This leader will pioneer AI and agentic automation to scale adversary emulation, threat hunting, and intelligence analysis across enterprise and product surfaces, partnering closely with the SOC.

The role reports to the Sr. Director of Cyber Defense Operations and can be remote or based in Austin, TX, offering leadership over a

Qualifications

• 8–10 years of experience in cybersecurity with at least 4 years leading blended threat intelligence and offensive security operations.
• AI/Automation acumen: integrating Generative AI, LLMs or agentic frameworks into cybersecurity workflows.
• SOC collaboration to improve defensive telemetry and detection maturity.
• Technical mastery across attack simulation frameworks, TIPs, and hands‑on scripting.

Responsibilities

• Lead unified program: direct the unified intelligence collection, analysis, and adversary emulation programs informed by CTI.
• Pioneer AI- and agentic-automation workflows to scale threat intelligence collection and emulation playbooks.
• Co-design purple-team exercises with SOC and ASM teams to translate findings into detection rules.
• Translate offensive testing results into strategic risk profiles and executive recommendations.
• Mentor and develop a diverse team of offensive security engineers and threat analysts.
• Oversee development of custom tools and APIs to automate data ingestion and reporting.
• Present threat briefings and risk assessments to cybersecurity leadership.

Skills

Adversary emulation

Threat intelligence

AI/Automation

Leadership & mentorship

SOC collaboration

Offensive security

Program management

Tools

Threat intelligence platforms (TIPs)

Scripting

Attack simulation frameworks

Job description

SailPoint’s Cybersecurity organization is seeking an Adversary Intelligence Manager with a passion for cybersecurity and protecting the organization. In a strategic move to elevate our Cyber Defense Operations, we are combining our Red Team and Cyber Threat Intelligence (CTI) functions into a single, unified Adversary Intelligence team. This team will strategically sit adjacent to our Security Operations Center (SOC) within the Cyber Defense Operations org. The successful candidate will lead this newly combined organization, uplifting our offensive and intelligence capabilities to continually test the security of our products, enterprise, and response readiness. This new leader will partner closely with our Security Operations Center (SOC) to drive threat-informed defensive measures and ensure seamless collaboration across our Cyber Defense Operations organization. We’re seeking a candidate with proven technical capabilities who can work on both the enterprise and application sides of the house, while pushing the boundaries of innovation. A key focus for this role will be pioneering the use of AI and agentic capabilities to automate, scale, and enhance adversary emulation, threat hunting, and intelligence analysis. Our new Adversary Intelligence Manager will embrace the opportunity to work across diverse platforms and will play a key role in shaping our future security posture. They’ll work with an established team of talented and dedicated teammates, guiding both emerging and established talent. They’ll naturally embody the 4 I’s at SailPoint (Individual, Impact, Innovation, and Integrity), embrace new challenges, and be a positive contributor to an already excellent work culture and environment. This is a challenging and impactful role where you will have the opportunity to work with both internal and external stakeholders, including our fantastic colleagues in IT, DevOps, Product Engineering, Security Engineering, and the wider Cyber Security team. This role reports directly to the Sr. Director of Cyber Defense Operations and can be remote or based in Austin, TX.

Responsibilities

• Lead Unified Program: Direct the unified intelligence collection, analysis, and adversary emulation programs, ensuring CTI directly informs and shapes targeted red team campaigns.
• Pioneer AI & Agentic Innovation: Architect and implement AI-driven and agentic automation workflows to scale threat intelligence collection, synthesize unstructured threat data, and dynamically execute emulation playbooks.
• SOC Partnership & Purple Teaming: Co-design collaborative purple-team exercises and continuous feedback loops with the SOC and Attack Surface Management (ASM) teams to rapidly translate offensive findings into robust detection engineering rules or prevention strategies.
• Strategic Risk Enumeration: Translate complex offensive testing results and emerging threat intelligence into strategic risk profiles and actionable, executive-level recommendations for business leaders.
• Team Leadership & Mentorship: Guide, mentor, and develop a diverse team of senior offensive security engineers and threat intelligence analysts, fostering a collaborative culture across historically distinct disciplines.
• Advanced Tool Development: Oversee the innovation of custom tools, techniques, and APIs to automate data ingestion, intelligence reporting, and dynamic adversary emulation.
• Executive Briefings: Present high-impact threat briefings, risk assessments, and incident post-mortems to cybersecurity leadership and broader enterprise stakeholders.

Requirements

• Meet FedRAMP access requirements. 8–10 years of experience in cybersecurity, with at least 4 years managing or leading blended threat intelligence and offensive security (Red Team / Purple Team) operations.
• AI/Automation Acumen: Practical exposure to or strong conceptual understanding of integrating Generative AI, Large Language Models (LLMs), or agentic frameworks into cybersecurity workflows.
• SOC & Defensive Collaboration: Proven track record of partnering with SOC, incident response, or detection engineering teams to improve overall defensive telemetry and detection maturity.
• Technical Expertise: Deep technical mastery across attack simulation frameworks, commercial/open-source threat intelligence platforms (TIPs), and hands‑on scripting/custom tool development.
• Strong leadership, communication, and program management abilities, with a history of building high‑performing, cross‑functional teams.
• Certifications: CISSP, OSCE/OSEP, GREM, GCTI, or equivalent demonstrable industry expertise.

Benefits and Compensation

Benefits and Compensation listed vary based on the location of your employment and the nature of your employment with SailPoint. As a part of the total compensation package, this role may be eligible for the SailPoint Corporate Bonus Plan or a role‑specific commission, along with potential eligibility for equity participation. SailPoint maintains broad salary ranges for its roles to account for variations in knowledge, skills, experience, market conditions and locations, as well as reflect SailPoint’s differing products, industries, and lines of business. Candidates are typically placed into the range based on the preceding factors as well as internal peer equity. We estimate the base salary, for US‑based employees, will be in this range from (min-max, USD): $124,100 - $209,214.00 Base salaries for employees based in other locations are competitive for the employee’s home location.

Benefits Overview

• Health and wellness coverage: Medical, dental, and vision insurance
• Disability coverage: Short‑term and long‑term disability
• Life protection: Life insurance and Accidental Death & Dismemberment (AD&D)
• Additional life coverage options: Supplemental life insurance for employees, spouses, and children
• Flexible spending accounts for health care, and dependent care; limited purpose flexible spending account
• Financial security: 401(k) Savings and Investment Plan with company matching
• Time off benefits: Flexible vacation policy
• Holidays: 8 paid holidays annually
• Sick leave
• Parental support: Paid parental leave
• Employee Assistance Program (EAP) and Care Counselors
• Voluntary benefits: Legal Assistance, Critical Illness, Accident, Hospital Indemnity and Pet Insurance options
• Health Savings Account (HSA) with employer contribution

SailPoint is an equal opportunity employer and we welcome all qualified candidates to apply to join our team. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, protected veteran status, or any other category protected by applicable law. Alternative methods of applying for employment are available to individuals unable to submit an application through this site because of a disability. Contact [e-mail] or mail to 11120 Four Points Dr, Suite 100, Austin, TX 78726, to discuss reasonable accommodations. NOTE: Any unsolicited resumes sent by candidates or agencies to this email will not be considered for current openings at SailPoint.

SailPoint is a leading provider of identity security for the modern enterprise. Enterprise security starts and ends with identities and their access, yet the ability to manage and secure identities today has moved well beyond human capacity. Using a foundation of artificial intelligence and machine learning, the SailPoint Identity Security Platform delivers the right level of access to the right identities and resources at the right time—matching the scale, velocity, and environmental needs of today’s cloud‑oriented enterprise. Our intelligent, autonomous, and integrated solutions put identity security at the core of digital business operations, enabling even the most complex organizations across the globe to build a security foundation capable of defending against today’s most pressing threats.

The employment policy of SailPoint is to provide equal opportunity to all persons, and it is SailPoint’s policy to take affirmative action to employ and advance in employment protected veterans and individuals with disabilities. It is SailPoint’s policy to recruit, hire, train and promote qualified individuals in all job titles, and ensure that all other personnel actions are administered without regard to race, color, religion, national origin, sex, military and/or veteran status, disability, or other legally protected status, and we will ensure that all employment decisions are based only on valid job requirements.

SailPoint does not discriminate on the basis of national origin or citizenship status as provided under the Immigration Reform and Control Act of 1986. Employees and applicants shall not be subjected to harassment, intimidation, threats, coercion, or discrimination because they have engaged in or may engage in any of the following activities: Filing a complaint; Assisting or participating in an investigation, compliance evaluation, hearing, or any other activity related to the administration of the affirmative action provisions of Section 503, VEVRAA, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans; Opposing any act or practice made unlawful by Section 503, VEVRAA, or their implementing regulations in this part, or any other Federal, State or local law requiring equal opportunity for individuals with disabilities or protected veterans; or Exercising any other right protected by section 503, VEVRAA or their implementing regulations.

SailPoint will also provide reasonable accommodation to known physical or mental limitations of an otherwise qualified employee or applicant for employment, unless the accommodation would impose undue hardship on the operation of our business. SailPoint’s affirmative action program contains an audit and reporting system which enables us to measure the effectiveness of our program, indicate any need for remedial action, determine the degree to which our objectives have been attained, determine whether protected veterans and individuals with disabilities had had the opportunity to participate in company-sponsored activities, measure our compliance with the program’s specific obligations, and document actions taken to comply with these obligations.