Security Operations Lead

About the role

The organization operates in the enterprise AI sector, providing a platform for specialized intelligence that enables companies to build, train, and serve AI models customized to their own data, workflows, and products. It addresses the challenge of deploying and managing AI models across text, image, audio, and multimodal workloads. Backed by leading investors, the company powers production AI with hundreds of state‑of‑the‑art open models and has grown to a Series D company valued at $17.5 billion.

The Security Operations Lead will establish and manage the security operations function, focusing on developing detection and response capabilities, managing incident response processes, and ensuring the security posture of the AI infrastructure platform as it scales globally. The role begins as an individual contributor with the potential to expand into a leadership position and requires collaboration across corporate security and infrastructure teams.

Responsibilities

• Lead deployment, tuning, and operation of CrowdStrike and SIEM tools across endpoint and cloud environments.
• Define and operate detection and response programs, including building detection content and managing escalation workflows.
• Manage incident response end‑to‑end, operationalizing playbooks, leading incidents, and conducting post‑incident reviews.
• Establish and manage security operations workflows and automation using SOAR platforms and incident management tools.
• Develop and execute a threat intelligence capability relevant to AI infrastructure and clientele.
• Collaborate with infrastructure, corporate security, and cross‑functional teams to support incident management and shared initiatives.

Requirements

• At least 7 years of experience in security operations, detection and response, or incident response.
• Hands‑on experience with EDR platforms, preferably CrowdStrike.
• Strong detection engineering skills, including writing, testing, and maintaining detection content.
• Proven leadership in incident response, managing incidents from triage through review.
• Proficiency in scripting and automation (Python, SOAR platforms) for detection and response workflows.
• Knowledge of cloud security operations across AWS, GCP, or Azure.
• Experience building or significantly developing a SecOps function, including tooling and process design.
• Ability to operate effectively in a build‑phase environment, balancing process and execution.