Manager, Security Operations & Incident Response

Davis Polk & Wardwell LLP; New York (NY); Hybrid; USD 240,000 - 300,000; Full time

Job summary

Davis Polk & Wardwell LLP in New York is seeking a Manager of Security Operations & Incident Response to lead detection, response, and governance across the Firm’s security program. This hands-on leadership role requires incident command experience and the ability to coordinate with legal counsel and external partners.

You will own the detection program, manage the MSSP relationship, and drive remediation of vulnerabilities and exposure, while building and mentoring a small senior team in a

Qualifications

• Minimum of 8 years’ experience in information security, including at least 3 years leading incident response or security operations.
• A Degree in Information Technology, Engineering or a related field.
• Key industry certifications such as GCIH, GCFA, GCIA, CISSP or CISM preferred.
• Hands-on depth with SIEM, endpoint detection and response; this is not a purely supervisory role.
• Experience governing a managed security service provider and reviewing provider output.

Responsibilities

• Serve as incident commander for security incidents, directing containment, evidence preservation, scope determination, eradication and recovery.
• Operate the incident response framework, triage events, incidents, severities and escalation.
• Produce incident documentation to evidentiary standards and coordinate with counsel and stakeholders.
• Lead post-incident reviews and drive root cause remediation and tabletop exercises.
• Own the detection program across SIEM, endpoint, identity, email and browser telemetry.
• Manage the relationship with the managed detection and response provider, including service levels and expansion of scope.
• Translate threat intelligence into detections, hunts and briefings; monitor threats relevant to the legal sector.
• Build, develop and grow a small senior security team; set priorities and on-call expectations.

Skills

Incident command

SIEM expertise

EDR / detection engineering

Threat detection

Communication with counsel

Governance & compliance

Vulnerability remediation

Education

Degree in IT/Engineering or related field

Industry certifications (GCIH/GCFA/GCIA/CISSP/CISM) preferred

Tools

SIEM platforms

EDR tools

Job description

## Manager, Security Operations & Incident ResponseApply: Hybrid: New York: Full time: Posted 2 Days Ago: JR10376Davis Polk & Wardwell LLP (including its associated entities) is an elite global law firm with world-class practices across the board. Clients know they can rely on Davis Polk for their most challenging legal and business matters. From offices in the world's key financial centers and political capitals, our more than 1,000 lawyers collaborate seamlessly to deliver exceptional service, sophisticated advice and creative, practical solutions. Visit davispolk.com.**Position Summary** The Manager, Security Operations & Incident Response leads the Firm’s ability to detect security threats and to respond when preventive controls fail. The role owns incident command, detection engineering, exposure management, threat intelligence, and governance of the Firm’s managed detection and response provider. The ideal candidate is a hands-on leader with demonstrated incident command experience, sound judgment under pressure, and the ability to work directly with the Firm’s General Counsel’s office and outside counsel. This is a working leadership role with responsibility for building, leading and growing a small, senior team. **Essential Duties and Responsibilities**Typical responsibilities include, but are not limited to, the following: * Serve as incident commander for security incidents, directing containment, evidence preservation, scope determination, eradication and recovery.* Operate the Firm’s incident response framework, including triage of Events of Interest, Incidents including severity determination and escalation.* Produce incident documentation to the Firm’s evidentiary standard, and coordinate with internal and external stakeholders, including matters conducted under legal privilege, supporting the CISO on notification analysis, cyber insurance and law enforcement engagement.* Lead post-incident review, drive root cause remediation through the responsible owners, and design and conduct tabletop exercises including exercises involving Firm leadership and counsel.* Own the detection program across SIEM, endpoint, identity, email and browser telemetry, including use case development, tuning and lifecycle management.* Measure and report detection coverage against prioritized MITRE ATT&CK techniques, and manage alert quality and false positive rates as primary measures of effectiveness.* Own the operational relationship with the Firm’s managed detection and response provider, including escalation paths, quality review of provider output, service level performance and expansion of scope.* Own the exposure management cycle across vulnerabilities, misconfigurations, attack paths and internet-facing exposure, prioritizing on known exploitation, asset criticality and privilege rather than severity score alone, and verifying remediation independently.* Translate threat intelligence into detections, hunts and briefings, track threat activity relevant to the legal sector and to the Firm’s client base, and own monitoring and takedown of brand impersonation and lookalike domains.* Lead, develop and grow a team of security analysts and engineers, setting priorities, quality standards and on-call expectations.* Provide operational input to security engineering on control design, and to governance and compliance on risk, metrics and audit evidence. **Qualifications/Position Requirements** * Demonstrated incident command during live security incidents, including direct coordination with legal counsel.* Hands-on depth with SIEM, endpoint detection and response, and detection engineering; this is not a purely supervisory role.* Experience governing a managed security service provider, including quality review of provider output rather than acceptance of it.* Practical command of MITRE ATT&CK, and familiarity with NIST SP 800-61, the NIST Cybersecurity Framework, and ISO27001.* Experience driving vulnerability and exposure remediation through teams outside the direct reporting line.* Calm, structured judgment under pressure, and the willingness to state clearly what is not yet known rather than declare an incident contained prematurely.* Written communication of a standard suitable for review by counsel and by Firm leadership, and strong interpersonal skills with the ability to influence at all levels of the organization.* Strong work ethic, and an excellent use of discretion and judgment in an environment handling privileged and market-sensitive information.* Experience in a law firm, professional services firm or financial institution preferred. **Education and/or Experience** * A Degree in Information Technology, Engineering or a related field.* Minimum of 8 years’ experience in information security, including at least 3 years leading incident response or security operations.* Key industry certifications such as GCIH, GCFA, GCIA, CISSP or CISM preferred. **Compensation**The expected base salary for this position ranges from $240,000 - $300,000. Salary offers are based on a wide range of factors including relevant skills, training, experience, education, and, where applicable, licensure or certifications obtained. Market and organizational factors are also considered. Davis Polk offers a competitive salary and comprehensive benefits package.