KLDiscovery is a leading global provider of best-in-class eDiscovery,
information governance, and data recovery solutions, serving AmLaw 100 firms,
Fortune 500 corporations, and government agencies. Our technology-enabled
services and software help these law firms, corporations and agencies solve
complex data challenges. Our Nebula and RelOne platforms deliver SaaS-based
legal technology underpinned by managed services and professional services. The
company, with offices in 26 locations across 17 countries helps clients with
their litigation, regulatory compliance, internal investigation and data
recovery and management needs all around the world.
Serving clients for over 30 years, KLDiscovery offers data collection and
forensic investigation, early case assessment, electronic discovery and data
processing, application software and data hosting for web-based document
reviews, and managed document review services. In addition, through its global
Ontrack Data Recovery business, KLDiscovery delivers world-class data recovery,
email extraction and restoration, data destruction and tape management.
KLDiscovery has been recognized as one of the fastest growing companies in North
America by both Inc. Magazine (Inc. 5000) and Deloitte (Deloitte’s Technology
Fast 500. Additionally, KLDiscovery is an Orange-level Relativity Best in
Service Partner, a Relativity Premium Hosting Partner and Relativity’s 1st
Service Provider partner, and maintains ISO/IEC 27001 Certified data centers.
The Director, Cybersecurity Operations leads Security Operations and Incident
Response, Security Engineering, Vulnerability Management, and Threat
Intelligence. This is a player-coach leadership role reporting directly to the
CISO, partnering with the Director, Cyber GRC as one unified cyber team. The
Director will bring hands-on technical depth, strong leadership capability, and
the ability to modernize security operations through MDR deployment, AI-informed
detection, and a security engineering team organized around functional
specialization.
This is a fully remote position
At KLD we invest in employees and their families by placing their wellbeing
first. We offer competitive total compensation that includes base pay, bonus
potential, inclusive benefits, wellness programs, and perks. We use market and
industry data to inform pay decisions while considering geography and labor
markets, individual experience, and business needs. Individual compensation will
vary, although a reasonable estimate of the current annualized base pay range
for this position is $175,000 to $215,000.
Key responsibilities
Security operations and incident response
Own the MDR relationship, including SLA management, escalation
accountability, detection tuning, and quarterly threat hunt reviews
Lead the incident response function: IR runbooks, major incident
coordination, executive communication during active incidents, and
post-incident root cause analysis
Oversee SOC detection engineering, ensuring SIEM rules, SOAR playbooks, and
automated response actions are maintained, tested, and tuned to the current
threat landscape
Direct and develop the security analyst pool, redeploying analyst capacity
from frontline triage toward MDR validation, threat hunt support, and
stakeholder reporting
Security engineering
Oversee four specialized engineering lanes [endpoint, identity, cloud, and
application security], ensuring each lane has clear ownership, defined scope,
and measurable outcomes
Drive security architecture reviews and engineering decisions for large or
complex IT projects, ensuring security requirements are built in rather than
bolted on
Shape the security tooling stack strategy, evaluating, selecting, and
retiring tools across endpoint, identity, cloud, and application security
Enforce automation-first engineering practices, including IaC security gates,
CI/CD pipeline security, CSPM auto-remediation, and SOAR-driven response
workflows
Threat intelligence, vulnerability management, and control validation
Lead the operationalization of threat intelligence, translating MDR findings
and external threat data into detection rule updates, architecture decisions,
and risk register inputs for the GRC team
Own the vulnerability management lifecycle: scanning coverage, risk-based
prioritization, remediation tracking, and SLA enforcement
Own the purple team and control validation program, confirming that deployed
controls operate as intended and that detection capabilities fire correctly
against known attack techniques
Drive threat modeling across the engineering function, identifying attack
paths before they are exploited and feeding findings into remediation
prioritization
AppSec, cloud, and AI security
Oversee the AppSec function: secure SDLC, code review gates, SAST/DAST
tooling, and security collaboration with the Product and Engineering teams
Own cloud security posture management: CSPM, cloud workload protection, cloud
IAM governance, and cloud-native security architecture
Set the team-wide AI security posture, overseeing AI security controls across
all engineering lanes, including model security, prompt injection testing,
and AI tool access governance in partnership with cyber leadership
MDR, automation, and tooling modernization
Lead the ongoing maturation of the MDR deployment, expanding coverage,
improving response fidelity, and integrating MDR outputs with internal SIEM,
IAM, and compliance evidence workflows
Champion security automation across the team, reducing manual toil in
detection, response, vulnerability tracking, and reporting through SOAR,
scripting, and platform integrations
Evaluate emerging security technologies and make build/buy/partner
recommendations to the CISO with clear business and risk rationale
Team leadership and CISO partnership
Lead, develop, and performance-manage a lean engineering team
Partner with the Director, Cyber GRC as one unified cyber function, feeding
operational threat intelligence into the risk register, supporting compliance
evidence for technical controls, and jointly presenting security posture
Provide regular metrics and reporting to the CISO on incident trends, control
coverage, MDR performance, vulnerability posture, and team development
Build a team culture of continuous improvement, automation-first execution,
and proactive security, where threat hunting and control validation are
protected activities rather than aspirational ones
Qualifications
Experience
15+ years of progressive experience in information security, including at
least 7 years in a security leadership role
Demonstrated ownership of a security operations or engineering function at
the Director or equivalent level
Experience operating and maturing an MDR deployment (CrowdStrike Falcon
Complete, Arctic Wolf, Expel, or equivalent) in a corporate environment
Hands-on background in at least two of the following: security engineering,
penetration testing/offensive security, cloud security, application security,
or incident response; this is not a purely strategic role
Demonstrated experience deploying or maturing security automation, such as
SOAR playbooks, detection engineering, IaC security, or CI/CD pipeline
security
Familiarity with cloud-native security (AWS, Azure, or GCP), including CSPM,
cloud IAM, and workload protection
Technical knowledge
Working knowledge of cybersecurity frameworks such as NIST SP 800-171, ISO
27001, and SOC 2
Understanding of the vulnerability management lifecycle: scanning,
prioritization, remediation tracking, and SLA enforcement
Familiarity with AppSec disciplines: SAST/DAST tooling, secure SDLC, and
security gate integration into CI/CD
Understanding of IAM security governance (PAM, access review programs, and
SSO/MFA architecture) as distinct from IT provisioning execution
Experience with AI security considerations (model testing, prompt injection,
AI tool access governance, and emerging AI governance frameworks such as the
NIST AI RMF and ISO 42001) is a meaningful differentiator
Foundational awareness of CMMC requirements
General abilities
An exceptional communicator, able to translate complex cyber risk and
compliance concepts into clear business language for executives, clients, and
regulators alike
A natural collaborator and client-facing presence, comfortable leading
enterprise client security discussions, representing KLDiscovery in due
diligence meetings, and building trust with external stakeholders
Business-minded, balancing security requirements against commercial realities
and making practical decisions without sacrificing rigor
A continuous learner with genuine curiosity, energized by a fast-growing
company and a rapidly evolving regulatory and threat landscape
Discreet and trusted, exercising sound judgment, maintaining confidentiality,
and operating with professionalism
Education
Bachelor's degree in Information Security, Computer Science, Engineering,
Business, or a related field required
Professional certifications such as CISSP, CISM, CISA, GPEN, GCIA, or other
GIAC certifications strongly preferred
Master's degree or MBA with a security focus preferred
Our mission and core values
Our Mission: We bring clarity, trust, and meaning to data for clients navigating
legal matters worldwide.
Client is Always in the Room - We operate and make decisions as if the client
is in the room. We anticipate their needs, consider their perspective, and
prioritize their best interests.
Own the Outcome - We bring an unwavering bias for action, act with urgency,
and hold ourselves accountable to our clients, and each other.
Better Every Day - We improve our tomorrow by always striving to be better
than today. We embrace curiosity, question assumptions, and raise the bar
constantly.
Deliver Results Together - We collaborate obsessively to achieve shared
success. We assume good intentions, debate ideas thoughtfully, treat each
other with respect, and fully commit once decisions are made.
Our culture shapes our actions, our products, and the relationships we forge
with our customers.
At KLD, our people are at the heart of everything we do. We believe that when
our employees feel supported, valued, and empowered, they can thrive both
personally and professionally. That’s why we’re committed to fostering a
collaborative, inclusive workplace where you can grow your career, make
meaningful contributions, and enjoy a healthy work-life balance.
Our competitive benefits and programs are designed to support your well-being
and success. Depending on your location, these may include comprehensive health
and wellness benefits, retirement and financial programs, paid time off and
leave options, employee assistance resources, and professional development
opportunities.
We also embrace flexibility, offering remote work opportunities for most
employees to support work-life balance while keeping our teams connected and
collaborative. Certain roles may require an office-based or hybrid schedule
based on business and operational needs.
Wherever you’re located, you’ll be part of a global team that values your
contributions, supports your growth, and celebrates your success.
Benefits and eligibility vary by country, location, employment status, and
applicable plan or program requirements.