Director, Ransomware Detect & Respond

Summary

Join Halcyon, a leading provider of adaptive security platforms, as their Director, Ransomware Detect & Respond (RDR). In this role, you will build and lead a 24/7 Security Operations Center (SOC), focusing on continuous monitoring of the anti-ransomware platform and providing real-time threat visibility and customer support. You will establish scalable processes, develop a high-performing team, and collaborate with various departments to ensure customer safety. The position requires a strategic thinker with strong leadership and communication skills. You will be responsible for architecting and implementing a world-class SOC, developing SOPs and playbooks, and defining key performance indicators. This role also involves close collaboration with engineering and product teams to integrate threat intelligence and improve the monitoring platform.

Requirements

• 8+ years of hands-on experience in SOC leadership, security monitoring, or managed detection operations—ideally within a cybersecurity product organization
• Demonstrated track record of building and scaling a 24/7/365 SOC, including staffing, process design, and performance measurement
• Deep understanding of ransomware threat actor TTPs, attack chains, and typical enterprise telemetry (endpoint, network, cloud)
• Proven ability to translate threat intelligence into effective monitoring rules, dashboards, and alerting strategies
• Strong leadership and people-management skills: coaching analysts, driving accountability, and fostering collaboration under pressure
• Excellent written and verbal communication skills—able to convey technical findings and operational metrics to executives, product teams, and customers
• High emotional intelligence, with a calm, decisive demeanor during high-stress situations
• Proficiency with SIEM /analytics platforms (e.g., Splunk, Elastic, QRadar), log aggregation tools, and incident-tracking systems
• Bachelor’s degree in Computer Science, Information Security, or a related field (or equivalent experience)

Responsibilities

• Architect and implement a world-class, round-the-clock operations center focused exclusively on ransomware monitoring, detection, and customer support
• Develop and maintain standard operating procedures (SOPs), runbooks, and escalation playbooks that ensure consistent, high-quality triage of alerts and customer engagements
• Define and track key performance indicators (SLAs, MTTR , detection coverage, alert accuracy) to measure SOC effectiveness and drive continuous improvement
• Recruit, mentor, and manage a team of SOC analysts—creating clear career paths, training programs, and certification goals
• Foster a culture of accountability, collaboration, and continuous learning within the RDR team, ensuring analysts understand evolving ransomware tactics and our product’s telemetry
• Conduct regular exercises (e.g., tabletop drills, alert-handling simulations) to validate readiness and refine processes
• Partner with RISE (Research, Intelligence, Services, Engineering) to ensure that the latest threat intelligence and telemetry are integrated into our monitoring platform
• Work closely with Product and Engineering to validate that endpoint, cloud, and network telemetry feed into the SOC’s analytics system and that alert thresholds are appropriately tuned
• Collaborate with domain experts to translate new ransomware trends into actionable alert rules and automated workflows
• Oversee real-time monitoring of customer environments—identifying suspicious activity and guiding customers through initial investigation steps
• Serve as the primary escalation point for high-severity customer alerts: coordinate with Support, Engineering, and RISE to advise on containment, remediation, and recovery actions
• Maintain a customer-facing incident log that captures timelines, root-cause analyses, and lessons learned—feeding insights back to Product for feature improvements
• Ensure SOC processes align with relevant security frameworks ( NIST CSF , ISO 27001) and support customer compliance needs
• Coordinate periodic reviews of detection controls (e.g., tuning alert thresholds, reviewing false-positive/false-negative rates) to maintain optimal coverage
• Manage relationships with external vendors for threat intelligence feeds, monitoring tools, and log aggregation services

Preferred Qualifications

• Prior experience working in or leading a SOC at a security-focused product company
• Certifications such as CISSP , GCIH , or equivalent GIAC credentials
• Familiarity with SOAR or automation platforms to streamline alert handling and triage workflows
• Hands-on understanding of cloud security monitoring (AWS CloudWatch, Azure Sentinel, GCP Security Command Center)
• Demonstrated success developing and presenting SOC performance reports and post-incident analyses to leadership or customers

Benefits

• Comprehensive healthcare (medical, dental, and vision) with premiums paid in full for employees and dependents
• 401k plan with a generous employer contribution
• Short and long-term disability coverage, basic life and AD&D insurance plans
• Medical and dependent care FSA options
• Flexible PTO policy
• Parental leave
• Generous equity offering