Remote Director of Security Operations & Incident Response

National Debt Relief; Idaho; A distancia; USD 198.000 - 227.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Generous Medical, Dental, and Vision

401(k) with Company Match

Paid Holidays, Volunteer Time Off, and

12 weeks Paid Parental Leave

Pre-tax Transit Benefits

No-Cost Life Insurance

Wellness Incentive Program

Descripción de la vacante

National Debt Relief seeks a Director of Security Operations to lead detection, response, and threat-hunting across the enterprise. You will own IR, EDR, email security, and SIEM, setting strategy, staffing, budgets, and metrics, while remaining a working leader with incident commander duties.

This role requires 10+ years in information security, including 5 years in security operations, and a proven ability to lead teams, manage budgets, and communicate risk to executives.

Formación

• 10 years information security experience, including 5 years focused on security operations, incident response, or detection engineering, required
• 5 years of direct people leadership experience, including hiring, performance management, and on call ownership, required
• Experience owning a function level budget, vendor relationships, and a staffing plan, required
• Bachelor’s degree in information systems, computer science, or a related field, or equivalent practical experience
• Industry recognized certification(s) highly recommended: GCIH, GCIA, GCFA, CISSP, or CISM

Responsabilidades

• Own the detection and response strategy and multi year roadmap, and align it to enterprise risk, the threat landscape, and business priorities
• Lead, coach, and develop the security operations team, including hiring, scheduling, on call rotation, performance management, succession planning, and career development
• Operate as a player coach, taking incident commander duty, writing detections, and performing hands on analysis alongside the team
• Own the incident response program end to end, including the IR plan, severity model, escalation paths, tabletop exercises, evidence handling, and post incident review
• Own endpoint detection and response strategy and operations, including policy tuning, coverage assurance, containment workflows, and threat hunting
• Own email security, including phishing defense, mail authentication controls (SPF, DKIM, DMARC), user reporting workflows, and response to business email compromise attempts
• Own SIEM and detection engineering, including log source onboarding, detection development and testing, alert quality, and false positive reduction
• Build and maintain automation and runbooks that shorten response time and remove repetitive analyst work
• Develop threat informed detection coverage mapped to MITRE ATT&CK and validate it through purple team and control testing
• Define and report operational metrics including mean time to detect, mean time to respond, alert volume and quality, coverage, and containment effectiveness
• Coordinate with IT, engineering, legal, privacy, and communications during incidents, including support for regulatory and customer notification decisions
• Own budget, staffing plan, and vendor strategy for the detection and response stack, including managed service providers, tooling selection, and licensing
• Present program status, incident outcomes, and risk decisions to executive leadership, and support board, audit committee, and regulator reporting as requested
• Support audit and compliance requirements with evidence for monitoring, response, and control operation

Conocimientos

Incident response

Team leadership

Communication

Threat hunting

Detection engineering

MITRE ATT&CK knowledge

Vendor management

Educación

Bachelor's degree in CS/IS

GCIH/GCIA/GCFA/CISSP/CISM certifications recommended

Herramientas

SIEM platforms

EDR platforms

Email security controls

Okta/Entra ID

Python/PowerShell

Cloud security (AWS/Azure/GCP)

Descripción del empleo

National Debt Relief seeks a Director of Security Operations to lead detection, response, and threat-hunting across the enterprise. You will own IR, EDR, email security, and SIEM, setting strategy, staffing, budgets, and metrics, while remaining a working leader with incident commander duties.

This role requires 10+ years in information security, including 5 years in security operations, and a proven ability to lead teams, manage budgets, and communicate risk to executives.