MDR Manager

Guardz; Miami (FL); On-site; USD 120,000 - 170,000; Full time

Job summary

Guardz is seeking an experienced MDR Manager to lead our Security Operations team. You will oversee day-to-day MDR operations, ensure 24/7 coverage, and act as the final escalation point for Tier 3 threats in multi-tenant MSP environments.

You will mentor MDR Analysts, drive process improvements, and manage complex investigations with defensible documentation, partnering with product and engineering to strengthen detections.

Qualifications

• 5+ years in SOC, MDR, or IR handling complex attacks, incl. 2+ years in a leadership role.
• Hands-on with EDR (SentinelOne, CrowdStrike, Defender for Endpoint) and ITDR across Google Workspace.
• Proficient with SQL, BigQuery, or SPL/KQL for triage and hunting.
• Experience with MITRE ATT&CK aligned detection and threat-hunting practices.
• Excellent communication to explain high-risk findings to both technical and non-technical audiences.

Responsibilities

• Own 24/7 shift coverage, escalation paths, and on-call rotations to ensure continuous monitoring.
• Manage response SLAs and report SOC KPIs to leadership.
• QA on alerts/incidents; maintain and improve runbooks, playbooks, and SOC standards.
• Lead, mentor MDR Analysts; conduct 1:1s, training, and post-incident reviews.
• Act as technical lead for T3 incidents and document full lifecycle defenses.
• Correlate alerts across EDR, ITDR, and email security; perform proactive threat hunts.
• Utilize Guardz AI agents, BigQuery, SQL/KQL to triage and define incident scope at machine speed.
• Collaborate with MSPs on major incidents and feedback into product/threat research.

Skills

SOC leadership

Incident response

EDR experience

SQL / KQL

MITRE ATT&CK

Clear communication

Education

Bachelor's degree in cybersecurity / CS / IT

Tools

SentinelOne

CrowdStrike

Defender for Endpoint

Google BigQuery

Snowflake

Splunk

Elastic

Job description

Established in 2022, Guardz rapidly emerged as a noteworthy player in the cybersecurity sphere, securing $85M in funding and rallying a dedicated team of 120 industry professionals. Our vision is to foster a safer digital landscape for small and medium businesses across the globe. To this end, we introduced our comprehensive all-in-one platform, and continue to grow and expand our team, our partnerships and our revenue.

We are looking for an experienced MDR Manager to lead our Security Operations team. The ideal candidate combines strong technical expertise with operational leadership and enjoys developing analysts, improving processes, and managing complex security incidents across multi-tenant MSP environments.

As a hands‑on leader, you will oversee day‑to‑day MDR operations, including coverage, SLAs, quality, escalation tiers, and analyst development. You will also serve as the final escalation point for Tier 3 threats and lead the team through the most complex investigations.

Responsibilities:

• Own 24/7 shift coverage, tiering, and escalation paths so every alert reaches the right analyst and there are nogaps in monitoring or escalation. Participate in an on-call rotation with the team.
• Own response SLAs (time-to-triage, time-to-notify, MTTR) and report SOC KPIs (MTTD, MTTR, detection efficacy,false-positive rate, case aging, customer satisfaction) to leadership.
• Run QA on closed alerts and incidents, drive down false positives, and maintain the team's runbooks, playbooks,and SOC standards.
• Lead, coach, and mentor MDR Analysts: regular 1:1s, performance feedback, onboarding, and the T1-to-T3training path. Run tabletop exercises and post-incident reviews.
• Act as technical lead and final escalation point for T3 incidents (advanced malware, identity threats like MFAfatigue and token theft, active breaches), leading the full lifecycle with defensible documentation.
• Correlate alerts across EDR (SentinelOne, Defender for Endpoint), ITDR (M365, Google Workspace), and emailsecurity, and run proactive threat hunts aligned to MITRE ATT&CK.
• Use Guardz AI agents, Google BigQuery, and query languages such as SQL and KQL to triage, hunt across high-volume logs, and confirm incident scope at machine speed.
• Partner with MSPs on major incidents and posture reviews, and feed findings back into detection with product,threat research, and engineering.

Requirements:

• 5+ years in SOC, MDR, or Incident Response handling complex attacks, including 2+ years as a Team Lead, ShiftLead, or senior.
• Hands‑on expertise with EDR (SentinelOne, CrowdStrike, Defender for Endpoint) and ITDR (identity threatmanagement across M365 and Google Workspace).
• Hands‑on experience with Google BigQuery, Snowflake, Splunk, Elastic, or equivalent, and fluency in a querylanguage such as SQL, KQL, or SPL.
• Experience with MITRE ATT&CK-aligned detection, proactive threat hunting, and AI-driven triage engines,automated playbooks, or agentic SecOps platforms.
• Excellent communication skills, able to make high-risk technical findings clear to both technical and non-technicalaudiences.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or equivalent hands-onexperience.
• Preferred: CompTIA Security+, CompTIA CySA+, Microsoft SC-200, GIAC GCIH / GCIA / GCFA, or CISSP (orequivalent DoD 8570 / 8140 IAT Level II).