Security Operations Team Lead

Cyera; New York (NY); On-site; USD 180,000 - 240,000; Full time

Job summary

Cyera is seeking a Security Operations Team Lead to guide a team of engineers, act as incident commander, and own the SOC's daily health and roadmap. This player-coach role blends leadership with hands-on work in detection and response.

You will run the customer zero program, define guardrails, mentor engineers, and partner with security leadership to improve detection across AWS and cloud telemetry using AI-assisted workflows.

Qualifications

• 5+ years in security operations or incident response, including senior/lead-level work.
• Experience running significant incidents end to end.
• Led or mentored engineers.
• Strong Python and detection engineering across SIEM and cloud telemetry.
• Hands-on with AI-assisted workflows and agent-based security.
• AWS Security Certification or equivalent depth in AWS security
• Clear executive communication under pressure
• Knowledge of AWS security architecture, IAM and logging
• Experience with DSPM, DLP in security environments
• Familiar with FedRAMP, SOC 2, ISO 27001
• Certifications such as GCIH, GCFA, CISSP are a plus

Responsibilities

• Lead a team of Security Operations Engineers.
• Act as incident commander for major incidents.
• Own day-to-day health and improvement of the SOC.
• Run customer zero program and feed learnings back to Product.
• Define guardrails and playbooks; ensure audit trails.
• Set detection and response priorities with leadership.
• Design on-call and coverage arrangements.
• Hands-on investigations and code work with AI-assisted workflows.

Skills

Team Leadership

Incident Command

Detection Engineering

Python

SIEM

Cloud telemetry

AI-assisted workflows

Executive communication

Stakeholder Management

DSPM / DLP

Regulated environments

Cloud security

Education

AWS Certification (Security Specialty)

5+ years in security operations

FedRAMP / SOC 2 / ISO 27001

CISSP / GCFA / GCIH

Job description

• Join our team as the Security Operations Team Lead. You will lead a team of Security Operations Engineers, serve as incident commander for major incidents, and own the day-to-day health and improvement of our agentic SOC
• You will also run our customer zero program, in which we operate the Cyera platform on our own environment and feed what we learn back to Product. This is a player-coach role: you lead the team and stay hands-on
• The ideal candidate has 5 or more years in security operations or incident response, including senior or lead-level experience, has run significant incidents end to end, and has led or mentored engineers
• Team Leadership: Lead, coach, and develop the Security Operations team; set priorities, run the operational cadence, and build career paths
• Incident Command: Direct the response to major incidents, make containment calls, manage stakeholder communication, and own the after-action process
• SOC Operating Model: Own the metrics and roadmap for the agentic SOC and prioritize the improvements that move them
• Agentic Fleet Management: Own the fleet of security agents that handle first-pass triage, investigation, and response: define guardrails and human approval points, evaluate accuracy, keep an audit trail, and report impact on autonomous handling and analyst capacity
• Customer Zero Program: Own posture goals, remediation governance, the product feedback loop, and reporting for our internal Cyera deployment
• Detection and Response Strategy: Set detection and response priorities with the Security Engineering lead based on threat model and coverage
• Coverage: Design and run on-call and coverage arrangements, including any external or follow-the-sun support
• Hands-On Work: Take the hardest investigations, build detections and playbooks, and write code, with AI-assisted workflows as the default way of working
• Stakeholder Management: Represent Security Operations to security leadership and R&D; translate operational data into risk and status

• Technical Depth: Strong Python and detection engineering across SIEM and cloud telemetry; able to review and improve others’ work
• AI-Assisted Workflows: Hands-on experience running AI-assisted and and agent-based security workflows, with a clear view of where agents are reliable, where they fail, and how to measure both
• AWS Certification: AWS Security Specialty or Solutions Architect Associate, or equivalent demonstrated depth
• Incident Command: Experience running significant incidents end to end, including executive communication
• Operating Discipline: Experience defining metrics, running an operational cadence, and reporting to leadership
• Experience: 5 or more years in security operations, incident response, or detection engineering, including senior or lead-level work
• AWS Knowledge: Strong knowledge of AWS security architecture, IAM, logging, and cloud incident response
• Communication: Clear with executives and engineers; calm and decisive under pressure
• Leadership: Experience leading, mentoring, or managing engineers or analysts
• Data Security: Experience with DSPM, DLP, or operating a security product as an internal customer
• Regulated Environments: FedRAMP, SOC 2, or ISO 27001
• Certifications: GCIH, GCFA, CISSP, AWS Security Specialty, or similar