Note: The job is a remote job and is open to candidates in USA. Cyera is hiring a Security Operations Team Lead to lead its Security Operations Engineers and serve as incident commander for major incidents. The role owns the health and improvement of the agentic SOC and the internal Customer Zero program, while remaining hands-on with investigations, detections, and playbooks.
Responsibilities
- Team Leadership: Lead, coach, and develop the Security Operations team; set priorities, run the operational cadence, and build career paths
- Incident Command: Direct the response to major incidents, make containment calls, manage stakeholder communication, and own the after-action process
- SOC Operating Model: Own the metrics and roadmap for the agentic SOC and prioritize the improvements that move them
- Agentic Fleet Management: Own the fleet of security agents that handle first-pass triage, investigation, and response: define guardrails and human approval points, evaluate accuracy, keep an audit trail, and report impact on autonomous handling and analyst capacity
- Customer Zero Program: Own posture goals, remediation governance, the product feedback loop, and reporting for our internal Cyera deployment
- Detection and Response Strategy: Set detection and response priorities with the Security Engineering lead based on threat model and coverage
- Coverage: Design and run on-call and coverage arrangements, including any external or follow-the-sun support
- Hands-On Work: Take the hardest investigations, build detections and playbooks, and write code, with AI-assisted workflows as the default way of working
- Stakeholder Management: Represent Security Operations to security leadership and R&D; translate operational data into risk and status
Skills
- 5 or more years in security operations, incident response, or detection engineering, including senior or lead-level work
- Experience running significant incidents end to end, including executive communication
- Experience leading, mentoring, or managing engineers or analysts
- Hands-on experience running AI-assisted and agent-based security workflows, with a clear view of where agents are reliable, where they fail, and how to measure both
- Strong knowledge of AWS security architecture, IAM, logging, and cloud incident response
- AWS Security Specialty or Solutions Architect Associate, or equivalent demonstrated depth
- Strong Python and detection engineering across SIEM and cloud telemetry; able to review and improve others' work
- Experience defining metrics, running an operational cadence, and reporting to leadership
- Clear with executives and engineers; calm and decisive under pressure
- Experience with DSPM, DLP, or operating a security product as an internal customer
- FedRAMP, SOC 2, or ISO 27001
- GCIH, GCFA, CISSP, AWS Security Specialty, or similar
Benefits
- Unlimited PTO
- Paid holidays and sick time
- Health, vision, and dental insurance
- Life, short and long-term disability insurance
Company Overview
Company H1B Sponsorship