Threat Operations & Incident Response Lead

OpenKrill; United States; On-site; USD 200,000 - 250,000; Full time

Benefits offered by this job

Remote-friendly locations

Hybrid schedule

Office visits possible

Job summary

DriveWealth LLC is seeking a Security & Threat Operations Manager to build and mature the function protecting our brokerage platform and corporate environment. You will lead the team, set the roadmap, and deliver measurable improvements in threat detection, incident response, and exposure management.

You will own detection content, monitoring, and the exposure management lifecycle, coordinating with Security Engineering, DevOps, and Product teams across AWS, Kubernetes, and low-latency trading

Qualifications

• Over 10 years in security operations, detection engineering, incident response or related fields.
• Experience as Incident Commander during major security incidents with cross‑team coordination.
• Strong hands-on expertise in threat intel, detection content, SIEM and endpoint analytics.
• Scripting in Python/SQL or similar.
• Knowledge of AWS, Kubernetes, API security and endpoint telemetry.

Responsibilities

• Mature Security & Threat Operations via a measurable roadmap and operating model.
• Grow and lead the team through hiring, coaching, and performance management.
• Own detection program with threat intel, content development, hunting, and validation.
• Monitor and investigate across product and corporate environments (phishing, malware, API abuse, DDoS, insider threats).
• Oversee digital risk monitoring of external attack surfaces, leaked credentials, impersonation, and takedown coordination.
• Act as Incident Commander during significant security incidents and coordinate cross‑functional response.
• Partner to automate responses and define actions requiring business coordination.
• Own incident response lifecycle, including preparedness, containment, recovery, and post‑incident improvement.
• Oversee exposure management lifecycle from discovery to closure, coordinating with owners.
• Operate security controls such as DLP, WAF, and email filtering with DevOps & Product teams.
• Support audits, regulatory examinations, and remediation of findings.
• Ensure compliance with regulatory controls (SEC/FINRA) and align with GRC.

Skills

Security operations

Threat intelligence

Detection engineering

SIEM

Endpoint analytics

Incident response

Python/SQL scripting

AWS

Kubernetes

API security

Leadership

Education

Bachelor’s degree in a related field

Certifications such as CISSP, GCIH, GCIA or GCFA

Tools

SIEM platforms

Endpoint analytics tools

Threat hunting tools

Job description

DriveWealth LLC is seeking a Security & Threat Operations Manager to build and mature the function protecting our brokerage platform and corporate environment. You will lead the team, set the roadmap, and deliver measurable improvements in threat detection, incident response, and exposure management.

You will own detection content, monitoring, and the exposure management lifecycle, coordinating with Security Engineering, DevOps, and Product teams across AWS, Kubernetes, and low-latency trading