Security & Threat Operations Manager

DriveWealth; Colorado; Remote; USD 200,000 - 250,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Disability insurance

Paid Parental Leave

Wellness reimbursement

Company-provided phone

Personal development allowance

Generous PTO and holidays

Job summary

DriveWealth is seeking a Security & Threat Operations Manager to mature the function protecting our brokerage platform and corporate environment. You will lead the team, define the operating model, and drive improvements in detection, incident response, and exposure management.

In this hands-on leadership role, you will own detection content, monitoring, and incident response lifecycle, including acting as Incident Commander during significant security incidents and coordinating across

Qualifications

• 10+ years in security operations, threat detection, or IR.
• 3+ years leading technical teams and building ops functions.
• Incident Commander experience during major incidents.

Responsibilities

• Own detection program, threat intel, content development, and simulations.

Skills

Security operations

Incident Command

Threat intelligence

SIEM & endpoint analytics

Python/SQL scripting

AWS & Kubernetes

Risk and compliance

Team leadership

Education

Bachelor's degree or equivalent

Security certifications (CISSP/GCIH/GCIA/GCFA)

Tools

SIEM

Endpoint analytics

Threat intel tools

Job description

About Us

DriveWealth is on a mission to make investing easier. We believe that everyone should have the ability to control their financial future, and that access to financial markets should not be limited by geography, wealth, or legacy systems. We are a global B2B financial technology organization dedicated to democratizing access to financial independence around the world. Our mission is realized through an API-based platform, empowering our partners to offer seamless investing and trading experiences to clients worldwide, all from their mobile devices. Our technology provides partners with a modern, extensible toolkit, enabling traditional investment workflows and innovative techniques like fractional share ownership. DriveWealth has evolved into a global platform offering trading of US equities, mutual funds, ETFs, fixed income, and options.

There’s never been a better time to build a category-defining business and there has rarely been a team better positioned for this opportunity. Our culture blends the pace and agility of a fintech start-up with the impact, stability, and discipline of Wall Street. We encourage creativity and experimentation while ensuring institutional-grade execution and regulatory compliance in everything we do. Join us and help build the future of global investing!

About the Role

DriveWealth LLC is seeking a highly motivated and experienced Security & Threat Operations Manager to build and mature the function protecting our brokerage platform and corporate environment. Reporting to the Chief Information Security Officer, you will grow and lead the team, establish its operating model and roadmap, and deliver measurable improvements in threat detection, investigation, incident response, and exposure management.

In this hands‑on leadership role, you will own detection content and the exposure management lifecycle, security monitoring and incident response, operation and tuning of security controls, and turn threat intelligence into defensive improvements. You will act as Incident Commander during significant security incidents and coordinate response across technical and business teams. Partnering with Security Engineering, DevOps & Platform, and Product & Engineering, you will ensure defenses evolve along with our AWS platform, Kubernetes services, low‑latency trading infrastructure, and corporate technology within an innovative and entrepreneurial culture.

What You’ll Do

Program Maturity & Team Leadership

• Program Development: Mature Security & Threat Operations through a measurable roadmap, defined operating model, appropriate monitoring coverage, escalation procedures, and service provider oversight.
• Team Development: Grow and lead the team through hiring, coaching, training, career development, and performance management.

Threat Detection, Investigation & Intelligence

• Detection Engineering: Own the detection program incorporating threat intelligence, content development, proactive hunting, and validation through attack simulations and purple-team exercises. Treat detection content development as an engineering discipline.
• Monitoring & Investigation: Own security monitoring and investigation across product and corporate environments, including phishing, malware, credential compromise, API abuse, DDoS, and insider threats.
• Digital Risk Monitoring: Own digital risk monitoring covering external attack surfaces, leaked credentials, exposed data, impersonation, phishing domains, and takedown coordination.

Incident Response

• Automated Response: Partner with Security Engineering to build pre‑defined automated security response actions. Coordinate with business leaders on required response actions which cannot be automated or which require compensating actions to prevent unnecessary business disruption.
• Incident Management: Own the incident response lifecycle as Incident Commander, including preparedness, forensic evidence handling, containment, recovery validation, regulatory coordination, and post‑incident improvement.

Exposure Management & Control Operations

• Exposure Management: Own the exposure management lifecycle from discovery through verified closure, coordinating remediation with accountable system and product owners.
• Control Operations: Own the operation and tuning of operational security controls, such as DLP, WAF, email filtering, and identity compromise prevention in partnership with Security Engineering, DevOps & Platform, and Product & Engineering to meet evolving product and corporate technology requirements.

Compliance & Assurance

• Regulatory Controls: Partner with Legal, Compliance, Security Engineering and GRC to implement SEC and FINRA requirements, including SEC Rule 17a-3 and 17a-4 controls supporting record capture, preservation, integrity, access, and retrieval.
• Control Assurance: Partner with Security Engineering to automate control validation and evidence collection. Support audits and regulatory examinations, and drive remediation of technical findings.

You Bring

• 10+ years in security operations, detection engineering, incident response, or related disciplines, including 3+ years managing technical teams and experience building or maturing an operations function.
• Demonstrated experience serving as Incident Commander during significant security incidents, making decisions under pressure, coordinating multiple teams, and communicating clearly with executives and business stakeholders.
• Strong hands‑on expertise in threat intelligence, detection content development, SIEM and endpoint analytics, investigation, threat hunting, and defensive validation.
• Practical scripting or query skills in Python, SQL, or comparable languages.
• Working knowledge of AWS, Kubernetes, API security, identity, and Windows/macOS endpoint telemetry. Experience supporting production environments with demanding availability and latency requirements is preferred.
• Experience creating, operating, and tuning preventive controls such as DLP, WAF, and email filtering while managing false positives and business impact.
• Experience investigating insider threats and digital risks such as exposed credentials, impersonation, and phishing domains, with appropriate handling of sensitive information and coordination with HR and Legal.
• Strong people leadership, process design, and prioritization skills, with the ability to influence Engineering and IT, manage competing operational demands, and support on‑call escalation and incident response outside normal business hours.
• Familiarity with NIST CSF, incident response practices, and MITRE ATT&CK. Experience in regulated financial services, including SEC/FINRA environments and applicable incident, data protection, and recordkeeping obligations, is preferred.
• Bachelor’s degree in a related field or equivalent practical experience. Relevant certifications such as CISSP, GCIH, GCIA, or GCFA are a plus.

Location

This role is open to candidates in the following locations: New York City, Chicago, Austin, Dallas, Denver, Miami, San Francisco Bay Area, or Seattle.

• If based in New York or Chicago: This role is expected to come into the office on a cadence set by the Hiring Manager/Team.
• If based in Austin, Dallas, Denver, Miami, San Francisco, or Seattle: This is a fully remote role, though you may need to visit our onsite offices from time to time.
• If you're not based in one of the locations listed above, this role is not a fit, and we cannot accommodate remote work outside these locations.
• Applicants must be authorized to work for any employer in the U.S. DriveWealth does not sponsor or take over sponsorship of an employment visa at this time.

Pay Range

Pay Range: $200,000 – $250,000 USD

Working at DriveWealth

We do our best work when we're in the same room. To maintain the speed our partners expect, our New York, Chicago, and Lithuania teams work in office on a hybrid schedule. We've found that being physically side‑by‑side is the only way to solve complex problems in real‑time and stay truly accountable to the products we ship. When you're here, you're working directly with the people making the decisions.

We also provide competitive compensation, equity, and a 401(k) match. We also offer Medical insurance, Dental insurance, Vision insurance, Disability insurance, and Paid Parental Leave, along with a wellness reimbursement, a company‑provided phone, and a personal development allowance. Finally, we value the time you spend away from the office with generous Paid Time Off (PTO) and observed holidays.

• Competitive compensation, equity, and a 401(k) match.
• Medical insurance.
• Dental insurance.
• Vision insurance.
• Disability insurance.
• Paid Parental Leave.
• Wellness reimbursement.
• Company‑provided phone.
• Personal development allowance.
• Generous Paid Time Off (PTO) and observed holidays.

Work Authorization

Applicants must possess the legal right to work in the country where the position is located at the time of application. DriveWealth requires all employees to provide original documentation verifying their work authorization on or before their first day of employment.

For US-based roles: Applicants must be currently authorized to work in the United States on a full‑time basis without the need for current or future visa sponsorship. DriveWealth does not provide visa sponsorship or support for employment authorization, including transfers, at this time. Offers of employment are strictly contingent upon an individual’s ability to secure and maintain the legal right to work at the Company.

How We Think About AI

We leverage AI to work smarter and move faster. We seek AI‑curious talent who are proactive about using emerging tools to increase signal quality, reduce friction, and improve outcomes to deliver products faster, provide better service to our partners, and to streamline processes. Your ability to leverage our internal tools and technology to drive results is as important to us as your core domain expertise.

Compensation

Pay is generally based on the level, complexity, responsibility, location, and job duties/requirements of the specific position. We then source candidates with the requisite skills, expertise, education, training, and experience. This role is eligible for base, bonus, equity, 401(k) match, and heavily subsidized benefits and perks.

Equal Employment Opportunity

To build technology and products that are used and loved by people and solve real-world problems, we need to build a team with many different perspectives and experiences. We are an equal opportunity employer. We do not discriminate based on race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. We encourage candidates from all backgrounds to apply.