Director of Security Operations

About the role

The Director of Security Operations leads the team responsible for detection and response across the enterprise. This role owns incident response, endpoint detection and response, email security, and SIEM and detection engineering, along with the monitoring and automation that support them. The director sets the strategy, staffing model, budget, and operating metrics for the function, and remains a working leader who takes incident commander duty, builds detections, and reviews analyst work alongside the team.

Responsibilities

• Own the detection and response strategy and multi‑year roadmap, and align it to enterprise risk, the threat landscape, and business priorities
• Lead, coach, and develop the security operations team, including hiring, scheduling, on‑call rotation, performance management, succession planning, and career development
• Operate as a player‑coach, taking incident commander duty, writing detections, and performing hands‑on analysis alongside the team
• Own the incident response program end‑to‑end, including the IR plan, severity model, escalation paths, tabletop exercises, evidence handling, and post‑incident review
• Own endpoint detection and response strategy and operations, including policy tuning, coverage assurance, containment workflows, and threat hunting
• Own email security, including phishing defense, mail authentication controls (SPF, DKIM, DMARC), user reporting workflows, and response to business email compromise attempts
• Own SIEM and detection engineering, including log source onboarding, detection development and testing, alert quality, and false positive reduction
• Build and maintain automation and runbooks that shorten response time and remove repetitive analyst work
• Develop threat‑informed detection coverage mapped to MITRE ATT&CK and validate it through purple team and control testing
• Define and report operational metrics including mean time to detect, mean time to respond, alert volume and quality, coverage, and containment effectiveness
• Coordinate with IT, engineering, legal, privacy, and communications during incidents, including support for regulatory and customer notification decisions
• Own budget, staffing plan, and vendor strategy for the detection and response stack, including managed service providers, tooling selection, and licensing
• Present program status, incident outcomes, and risk decisions to executive leadership, and support board, audit committee, and regulator reporting as requested
• Support audit and compliance requirements with evidence for monitoring, response, and control operation

Qualifications

Education/Experience

• 10 years of information security experience, including 5 years focused on security operations, incident response, or detection engineering, required
• 5 years of direct people leadership experience, including hiring, performance management, and on‑call ownership, required
• Experience owning a function‑level budget, vendor relationships, and a staffing plan, required
• Bachelor’s degree in information systems, computer science, or a related field, or equivalent practical experience
• Industry recognized certification(s) highly recommended: GCIH, GCIA, GCFA, CISSP, or CISM

Required Skills/Abilities

• Hands‑on operational experience with SIEM platforms, including query authoring, data modeling, and detection development
• Hands‑on experience with EDR platforms, including policy design, containment actions, and threat hunting
• Experience operating email security controls and phishing response at scale
• Working knowledge of attacker tradecraft including initial access, persistence, privilege escalation, lateral movement, and exfiltration
• Practical use of MITRE ATT&CK for coverage assessment and detection planning
• Incident response and forensic practice, including host and cloud artifact analysis, chain of custody, and timeline construction
• Cloud detection and response experience in AWS, Azure, or GCP, including identity provider telemetry such as Okta or Entra ID
• Scripting and automation ability (Python, PowerShell, or similar) for enrichment, response actions, and SOAR workflows
• Strong knowledge of TCP/IP, DNS, HTTP, and operating system internals for Windows and macOS
• Knowledge of secure configuration management and endpoint security technologies across multiple platforms
• Understanding of compliance areas including controls for SOC 2, PCI DSS, and applicable state privacy and breach notification requirements
• Ability to remain calm and decisive during active incidents and to communicate status clearly to technical and executive audiences
• Strong verbal and written communication, including the ability to translate technical risk into business terms for non‑technical stakeholders
• Proven ability to build rapport and durable working relationships with business, IT, and engineering leaders
• Ability to influence without direct authority and to position security as a pragmatic, value‑added partner rather than a control function
• Strong documentation and communication skills
• Curious, inquisitive, innovative, lifelong learner and self‑starter
• Able to effectively give, receive, and respond to feedback

National Debt Relief Role Qualifications

• Computer competency and ability to work with a computer
• Prioritize multiple tasks and projects simultaneously
• Exceptional written and verbal communication skills
• Punctuality expected, ready to report to work on a consistent basis
• Attain and maintain high performance expectations on a monthly basis
• Work in a fast‑paced, high‑volume setting
• Use and navigate multiple computer systems with exceptional multi‑tasking skills
• Remain calm and professional during difficult discussions
• Take constructive feedback
• Available for full‑time position

Pay

The salary for this position is $197,500.00 to $227,000.00. Our salary ranges are determined by role, level, and location. The range displayed reflects the minimum and maximum target for each position across the US. Within the range, individual pay is determined by work location, job‑related skills, experience, and relevant education or training. This good faith pay range is provided in compliance with NYC law and the laws of other jurisdictions that may require a salary range in job postings.

About National Debt Relief

National Debt Relief was founded in 2009 with the goal of helping an expanding number of consumers deal with overwhelming debt. We are one of the most‑trusted and best‑rated consumer debt relief providers in the United States. As a leading debt settlement organization, we have helped over 450,000 people settle over $10 billion of debt, while empowering them to lead a healthier financial lifestyle and feel free to live their best life. At National Debt Relief, we treat our clients like real people. Our purpose is