Security Operations and Incident Response Lead

About the Role

This is a new role based in Cupertino. You will run security operations, own incident response, and close a specific gap we have identified: the security risk created by integrations between our business systems, including the AI tools and agents now connected to them. You will work alongside our existing IT, security, and GRC teams in San Jose, Taipei, and Hangzhou. You will not take over those teams. Your results will depend on working well with them. This role reports to the VP of Security and Compliance.

Key Responsibilities

• Security operations
  • Run day to day security monitoring across endpoints, identity, cloud, and SaaS applications. Triage alerts, investigate, and escalate.
  • Improve detection quality. Tune alerts so that real problems surface and noise is removed.
  • Build monitoring coverage that works across Cupertino and Taipei time zones.
  • Define and report security operations metrics: time to detect, time to triage, time to remediate, escalation accuracy, and coverage gaps.
  • Work with our endpoint security and identity security engineers in Taipei, who own those platforms, so that detection reflects how the systems are actually configured.
• Incident response
  • Own the incident response program. Keep the plan current and track corrective actions until they are closed.
  • Own tabletop exercise program. Run exercises on a regular schedule and choose scenarios from current threat activity rather than from a generic list. Cover supply chain, 3rd/4th party compromise, ransomware, and business system or integration compromise.
  • Bring the right people into each exercise, technical responders for operational exercises, and executives, Legal and communications for decision level exercises.
  • Track every finding an exercise produces until it closed.
  • Lead active incidents: coordinate containment, recovery, evidence handling, and the written timeline.
  • Keep external incident support ready to use. Security leadership owns the relationships with outside counsel, forensics, insurance, and law enforcement. You make sure escalation paths have been tested and evidence handling is prepared before those partners are engaged.
  • Write the post incident report and drive the corrective actions it produces to completion.
• Threat landscape and threat hunting
  • Turn intelligence into action. Every item that matters should produce something concrete – a new detection rule, a hunt through historical data, a configuration change, an internal advisory, or a tabletop scenario.
  • Hunt proactively. Look for activity we have no alert for yet, using current intelligence as the starting point.
  • When a vendor or industry breach notice lands, determine whether we are exposed and formulate a prompt response. Feed the results into the integration inventory and into detection.
  • Report what changed as a result: detections shipped, gaps closed, or risks accepted, not just intelligence reviewed.
• Business system integration risk
  • Build and maintain a current inventory of the integrations between our business systems: connectors, OAuth grants, service accounts, API tokens, and the data that moves between them.
  • Assess the security risk of a new integration before it is enabled, and say no when the risk is not acceptable.
  • Make sure we know what a compromise at a connected vendor would reach, and that we can answer that question in hours rather than weeks.
  • Build detection for SaaS and integration abuse, not only endpoint activity.
  • Establish containment playbooks so an integration can be disconnected quickly during an incident, with decision rights agreed in advance rather than debated at the time.
  • This integration surface covers 200 or more SaaS vendors with no existing security scoping today. Manual inventory alone will not produce the hours-not-weeks answer this role is expected to give, so a SaaS Security Posture Management (SSPM) tool is a Day One dependency for this role, not something to earn later.
• AI usage and agent risk
  • Maintain visibility into how AI tools are used across the company – platforms, browser extensions, and vibe-coding tools staff adopt on their own without asking.
  • Treat AI agents as identities. Inventory and govern the agents, service accounts, and OAuth grants that allow AI tools to act inside our business systems, and hold them to the same review standard as any other integrations.
  • Assess new AI tools before adoption – what data they receive, where it is processed and retained, whether they can act on our behalf, and what a compromise of that tool would reach.
  • Build detection for AI-specific risk – company data leaving through AI services, credentials or customer data pasted into prompts, and prompt injection against systems that use AI.
  • Own the incident response playbook for AI-related incidents, including data exposure through an AI service and a compromised or misbehaving agent.
• Working relationships and compliance
  • Partner with general IT in San Jose, Taipei, and Hangzhou; endpoint security and identity security in Taipei; and GRC in San Jose and Taipei.
  • Act as control owner for the security operations and incident response controls in scope for ISO 27001:2022 and SOC 2. The GRC team runs the audits. You keep your own domain evidence ready and answer auditor questions in your area.
  • Support our EU obligations under NIS2 and the Cyber Resilience Act by delivering accurate facts inside a 24 to 72 hour reporting window. GRC, Legal, and Product Engineering own interpretation and reporting decisions.
  • Expect regular early morning or evening calls to overlap with Asia, with some occasional travel.

Requirements

• 10 or more years in information security, with real depth in security operations.
• You have run a security operations function or built one. You know what good detection looks like and what it costs to maintain.
• You have led incidents from first alert to final report, including briefing leadership and working with outside counsel or forensics.
• You understand SaaS and integration risk specifically: OAuth grants, service accounts, API tokens, and third party connectors. You have investigated or contained an incident that arrived through one.
• You have turned threat intelligence into a detection rule or a hunt yourself. You treat an advisory as work to do, not as an email to forward.
• A working view on AI and agent risk. You do not need years of it but you should be able to explain what you would inventory first and what you would block outright.
• You can influence teams that do not report to you, across sites and cultures.
• Clear written English. You can explain the same risk to an engineer, an executive, and an enterprise customer without changing the facts.
• Comfortable working across US and Asia time zones.

Nice to Have

• Experience at SaaS, remote access, endpoint management, or MSP focused companies.
• A security certification such as CISSP, CISM, or GCIH if you have one. We care more about what you have built and run than what you have passed.
• Hands on experience with CrowdStrike Falcon, SIEM, MDM, or detection engineering.
• Familiarity with EU regulatory requirements: NIS2, the Cyber Resilience Act, or GDPR.
• Scripting and automation skills, and comfort using AI assisted tools — our compliance program runs on an internal platform, not spreadsheets.
• Mandarin language ability.

What We Offer

• A dynamic and supportive work environment.
• A competitive salary and performance-based incentives.
• Incredible and continuous learning experience for professional growth and development.
• Fast-paced environment where we celebrate successes and have a lot of fun while working.
• An amazing crew of other hard working and passionate people from all over the globe.