Senior Security Operations & Incident Response Leader

davispolk; New York (NY); On-site; USD 240,000 - 300,000; Full time

Job summary

davispolk is seeking a Manager, Security Operations & Incident Response to lead the Firm's ability to detect security threats and to respond when preventive controls fail. The role owns incident command, detection engineering, exposure management, threat intelligence, and governance of the Firm's managed detection and response provider.

This is a hands-on leadership role with responsibility for building, leading and growing a small, senior team in a high-stakes environment.

Qualifications

• Degree in Information Technology, Engineering or related field.
• Minimum of 8 years in information security, including at least 3 years leading incident response or security operations.
• Key industry certifications such as GCIH, GCFA, GCIA, CISSP or CISM preferred.

Responsibilities

• Serve as incident commander for security incidents, directing containment, evidence preservation, scope determination, eradication and recovery.
• Operate the Firm's incident response framework, including triage of Events of Interest, Incidents including severity determination and escalation.
• Produce incident documentation to the Firm's evidentiary standard, and coordinate with internal and external stakeholders, including matters conducted under legal privilege, supporting the CISO on notification analysis, cyber insurance and law enforcement engagement.
• Lead post-incident review, drive root cause remediation through the responsible owners, and design and conduct tabletop exercises including exercises involving Firm leadership and counsel.
• Own the detection program across SIEM, endpoint, identity, email and browser telemetry, including use case development, tuning and lifecycle management.
• Measure and report detection coverage against prioritized MITRE ATT&CK techniques, and manage alert quality and false positive rates as primary measures of effectiveness.
• Own the operational relationship with the Firm's managed detection and response provider, including escalation paths, quality review of provider output, service level performance and expansion of scope.
• Own the exposure management cycle across vulnerabilities, misconfigurations, attack paths and internet-facing exposure, prioritizing on known exploitation, asset criticality and privilege rather than severity score alone, and verifying remediation independently.
• Translate threat intelligence into detections, hunts and briefings, track threat activity relevant to the legal sector and to the Firm's client base, and own monitoring and takedown of brand impersonation and lookalike domains.
• Lead, develop and grow a team of security analysts and engineers, setting priorities, quality standards and on‑call expectations.
• Provide operational input to security engineering on control design, and to governance and compliance on risk, metrics and audit evidence.

Skills

Incident command

SIEM

EDR

Threat intelligence

Governance

Education

Bachelors in IT/Engineering or related field

8+ years information security

Tools

SIEM platforms

EDR tools

Threat intel platforms

MITRE ATT&CK knowledge

Job description

davispolk is seeking a Manager, Security Operations & Incident Response to lead the Firm's ability to detect security threats and to respond when preventive controls fail. The role owns incident command, detection engineering, exposure management, threat intelligence, and governance of the Firm's managed detection and response provider.

This is a hands-on leadership role with responsibility for building, leading and growing a small, senior team in a high-stakes environment.