Senior Manager, Security Operations
for section headings (e.g. About the role, Responsibilities...). Likely we should stick to those headings if content matches. "Who We Are" could be considered "About the role"? Actually "About The Role" heading present. So we have "About The Role" section after Who We Are. So we should include About the role
with its content.
Then "What You’ll Do" corresponds to Responsibilities.
Then "What We’re Looking For" corresponds to Requirements (or Qualifications). We'll use Requirements.
Then "Benefits": there is a paragraph about benefits after Pay Transparency? Actually after "Pay Transparency" there is a paragraph: "Motive offers benefits including health, pharmacy, optical and dental care benefits, paid time off, sick time off, short term and long term disability coverage, life insurance as well as 401k contribution (all benefits are subject to eligibility requirements). Learn more about our benefits by visiting Motive Perks & Benefits". That's benefits.
Then Pay: "The Base Compensation Range For This Role Is $140,000—$200,000 USD". Also earlier "Pay Transparency Your compensation may be based on several factors...". We'll include Pay section with that range.
Schedule: not present, so omit.
Skills: not explicit separate; could be part of Requirements but we can omit.
We must not include boilerplate like EEO, equal opportunity, etc. Also remove "Creating a diverse and inclusive workplace..." etc. Also remove "Please review our Candidate Privacy Notice..." etc. Also remove "UK Candidate Privacy Notice". Also remove "The applicant must be authorized..." etc. Also remove "All job postings are for existing vacancies..." etc. Also remove "Please note; some interviews..." etc.
We must preserve all substantive information: that includes Who We Are description? It's not under a heading but maybe we should include as a paragraph before About the role? The instruction says output only HTML fragment; we can include a
for the Who We Are description as introductory text. It's substantive. Not a heading. We must not repeat job title as heading. The job title is "Senior Manager, Security Operations". Not used. We must not put Job ID/requisition numbers as headings; none present. We must use
for section headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We need to decide what content is list vs prose.
For About the role: It's a paragraph describing the role. Could be
.
For Responsibilities: bullet list of duties. The text under "What You’ll Do" includes multiple sentences each starting with a verb. Could be turned into
- . We'll extract each bullet.
Let's list them:
- Stand up and grow the SOC — operating model, coverage structure, runbooks, escalation paths, hiring and career development for a globally distributed team — and decide the 24/7 coverage model, whether in-house follow-the-sun, MDR-augmented or hybrid
- Own Motive's detection strategy and coverage posture across both estates, treating detection content as code and mapping coverage explicitly against MITRE ATT&CK and Motive's own threat model, with a live view of gaps closed in risk order
- Extend detection into production and cloud workloads in close partnership with Platform Engineering — the highest-priority coverage expansion for the function — and build detections that span the boundary, since identity compromise on a corporate endpoint pivoting into cloud infrastructure is the attack path that matters most
- Own 24/7 incident response across product and enterprise environments, serve as incident commander for significant incidents, and be the calm, credible voice to executives when one is underway
- Own the security telemetry and analytics platform — collection, normalization, enrichment, retention and cost — and instrument the function honestly on MTTD, MTTR, detection coverage, alert precision and automation rate
- Establish a structured, hypothesis-driven threat hunting program and a threat intelligence capability tailored to Motive's sector, translating intel into detections, hunts and hardening priorities rather than newsletters
- Own EDR across the corporate fleet and, with Platform Engineering, runtime and workload protection for production, treating any unmonitored endpoint as an open finding rather than an accepted condition
- Own the operational side of phishing and social engineering defense — detection, reporting triage, takedown and credential-compromise response — partnering with the Compliance and Trust function, which owns simulation and awareness training
- Architect the AI-first operating model for the SOC, personally building and iterating on triage, enrichment, correlation and investigation automation rather than delegating it to a vendor
That's a list.
For Requirements: "What We’re Looking For" includes multiple bullet-like sentences. We'll turn into list.
Extract each:
- 8+ years in security operations, incident response, detection engineering or threat intelligence, with 3+ years leading teams
- Demonstrably hands-on. You have personally written detections, run investigations, led incidents as commander and built automation — recently, not early in your career. Be prepared to walk through work you did with your own hands
- Experience building or substantially rebuilding a SOC function, rather than only operating within an established one
- Credible across both estates — production and cloud security monitoring as well as corporate and enterprise security operations. Candidates strong in only one should be ready to show how they would build the other
- Deep experience with modern detection and response tooling — SIEM and security data platforms, EDR, SOAR or equivalent automation, and cloud-native telemetry — plus strong detection engineering skills you can apply personally
- Strong background in cloud and container security monitoring, with AWS and Kubernetes strongly preferred, including the practical reality that production monitoring must be introduced without destabilizing production
- Solid grounding in identity-centric attack paths — SSO, OAuth, session compromise, MFA bypass and privilege escalation across SaaS and cloud
- Proven incident command experience on significant incidents, including executive communication under pressure, and the judgment to escalate appropriately without crying wolf or sitting on something serious
- Concrete, demonstrated use of AI to run security operations — triage, enrichment, detection authoring, investigation support or reporting. We will ask what you built, what it replaced, and what it measurably changed. General enthusiasm for AI is not what we're looking for
- Experience building 24/7 coverage and leading globally distributed teams across multiple timezones. Experience in transportation, logistics, IoT and connected devices, or critical infrastructure is a plus
We'll make each a
- .
Benefits: list of benefits: health, pharmacy, optical and dental care benefits, paid time off, sick time off, short term and long term disability coverage, life insurance as well as 401k contribution. Could be list.
Pay: just a sentence: Base Compensation Range $140,000—$200,000 USD. Could be
.
We also have earlier "Pay Transparency Your compensation may be based on several factors, including education, work experience, and certifications. For certain roles, total compensation may include restricted stock units." That's also substantive about compensation. Should we include? It's about compensation. Could be included in Pay section as additional prose. The instruction: include Pay section only if posting actually states them. It does state compensation factors. So we can include that as part of Pay section.
Thus Pay section could have
about compensation factors and then maybe
about base range. Or combine.
We must not include boilerplate like "Learn more about our benefits by visiting Motive Perks & Benefits" - that's a link; maybe we can keep as part of benefits? It's a reference; but it's not substantive detail; it's a call to action. Might be considered boilerplate? It's not EEO but it's a navigation link. Safer to omit that sentence. Keep only the benefits list.
Similarly, we should omit "Visit gomotive.com to learn more." from Who We Are? That's a call to action; maybe considered boilerplate? It's not essential. Might be okay to keep? The instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. "Visit gomotive.com to learn more." is navigation/link; could be considered navigation. Safer to omit.
Also "Learn more about our benefits by visiting Motive Perks & Benefits" is navigation; omit.
Now construct HTML.
We'll start with a
for Who We Are description (excluding the visit link). Who We Are paragraph: "Motive empowers the people who run physical operations with tools to make their work safer, more productive, and more profitable. For the first time ever, safety, operations and finance teams can manage their drivers, vehicles, equipment, and fleet related spend in a single system. Combined with industry leading AI, the Motive platform gives you complete visibility and control, and significantly reduces manual workloads by automating and simplifying tasks. Motive serves nearly 100,000 customers – from Fortune 500 enterprises to small businesses – across a wide range of industries, including transportation and logistics, construction, energy, field service, manufacturing, agriculture, food and beverage, retail, and the public sector."
We'll put that as
.
Then
About the role
then with the role description: "We are hiring a Senior Manager, Security Operations to build, lead and grow Motive's SOC. This is a founding leadership role — you will shape the team, the tooling, the detection strategy and the operating model rather than inheriting a mature organization and maintaining it. Reporting to the CISO, you will own the full detection and response lifecycle: detection engineering, 24/7 incident response, threat hunting, threat intelligence, security analytics, and endpoint and workload security. The scope spans Motive's entire estate. Product and production environments cover the cloud infrastructure, services, APIs and data platforms behind Fleet Management, Driver Safety, Spend Management, Workforce Management and AI Vision, plus the connected device fleet. Enterprise and corporate systems cover endpoints, identity and SSO, SaaS applications, network, email and internal tooling. These estates have different telemetry, threat models and response constraints — you cannot contain a production workload the way you isolate a laptop — and a central part of this role is running them as one detection and response capability with one view of the adversary, because real attacks cross the boundary between them. The mandate is coverage: we want to detect everything that goes wrong. That is a deliberately high bar, and it is an engineering problem rather than a staffing problem. We expect this SOC to be built AI-first and data-driven from day one, designed around automation from the start rather than staffing a traditional tiered analyst model and layering automation on later. Success looks like a small, senior, highly leveraged team whose time goes to hard problems, not queue processing."
Then
Responsibilities
then with each - .
Then
Requirements
then with each - .
Then
Benefits
then with each benefit.
Benefits list: health, pharmacy, optical and dental care benefits, paid time off, sick time off, short term
for prose. We need to decide what content is list vs prose. For About the role: It's a paragraph describing the role. Could be
. For Responsibilities: bullet list of duties. The text under "What You’ll Do" includes multiple sentences each starting with a verb. Could be turned into
- . We'll extract each bullet. Let's list them: - Stand up and grow the SOC — operating model, coverage structure, runbooks, escalation paths, hiring and career development for a globally distributed team — and decide the 24/7 coverage model, whether in-house follow-the-sun, MDR-augmented or hybrid - Own Motive's detection strategy and coverage posture across both estates, treating detection content as code and mapping coverage explicitly against MITRE ATT&CK and Motive's own threat model, with a live view of gaps closed in risk order - Extend detection into production and cloud workloads in close partnership with Platform Engineering — the highest-priority coverage expansion for the function — and build detections that span the boundary, since identity compromise on a corporate endpoint pivoting into cloud infrastructure is the attack path that matters most - Own 24/7 incident response across product and enterprise environments, serve as incident commander for significant incidents, and be the calm, credible voice to executives when one is underway - Own the security telemetry and analytics platform — collection, normalization, enrichment, retention and cost — and instrument the function honestly on MTTD, MTTR, detection coverage, alert precision and automation rate - Establish a structured, hypothesis-driven threat hunting program and a threat intelligence capability tailored to Motive's sector, translating intel into detections, hunts and hardening priorities rather than newsletters - Own EDR across the corporate fleet and, with Platform Engineering, runtime and workload protection for production, treating any unmonitored endpoint as an open finding rather than an accepted condition - Own the operational side of phishing and social engineering defense — detection, reporting triage, takedown and credential-compromise response — partnering with the Compliance and Trust function, which owns simulation and awareness training - Architect the AI-first operating model for the SOC, personally building and iterating on triage, enrichment, correlation and investigation automation rather than delegating it to a vendor That's a list. For Requirements: "What We’re Looking For" includes multiple bullet-like sentences. We'll turn into list. Extract each: - 8+ years in security operations, incident response, detection engineering or threat intelligence, with 3+ years leading teams - Demonstrably hands-on. You have personally written detections, run investigations, led incidents as commander and built automation — recently, not early in your career. Be prepared to walk through work you did with your own hands - Experience building or substantially rebuilding a SOC function, rather than only operating within an established one - Credible across both estates — production and cloud security monitoring as well as corporate and enterprise security operations. Candidates strong in only one should be ready to show how they would build the other - Deep experience with modern detection and response tooling — SIEM and security data platforms, EDR, SOAR or equivalent automation, and cloud-native telemetry — plus strong detection engineering skills you can apply personally - Strong background in cloud and container security monitoring, with AWS and Kubernetes strongly preferred, including the practical reality that production monitoring must be introduced without destabilizing production - Solid grounding in identity-centric attack paths — SSO, OAuth, session compromise, MFA bypass and privilege escalation across SaaS and cloud - Proven incident command experience on significant incidents, including executive communication under pressure, and the judgment to escalate appropriately without crying wolf or sitting on something serious - Concrete, demonstrated use of AI to run security operations — triage, enrichment, detection authoring, investigation support or reporting. We will ask what you built, what it replaced, and what it measurably changed. General enthusiasm for AI is not what we're looking for - Experience building 24/7 coverage and leading globally distributed teams across multiple timezones. Experience in transportation, logistics, IoT and connected devices, or critical infrastructure is a plus We'll make each a
- .
Benefits: list of benefits: health, pharmacy, optical and dental care benefits, paid time off, sick time off, short term and long term disability coverage, life insurance as well as 401k contribution. Could be list.
Pay: just a sentence: Base Compensation Range $140,000—$200,000 USD. Could be
. We also have earlier "Pay Transparency Your compensation may be based on several factors, including education, work experience, and certifications. For certain roles, total compensation may include restricted stock units." That's also substantive about compensation. Should we include? It's about compensation. Could be included in Pay section as additional prose. The instruction: include Pay section only if posting actually states them. It does state compensation factors. So we can include that as part of Pay section. Thus Pay section could have
about compensation factors and then maybe
about base range. Or combine. We must not include boilerplate like "Learn more about our benefits by visiting Motive Perks & Benefits" - that's a link; maybe we can keep as part of benefits? It's a reference; but it's not substantive detail; it's a call to action. Might be considered boilerplate? It's not EEO but it's a navigation link. Safer to omit that sentence. Keep only the benefits list. Similarly, we should omit "Visit gomotive.com to learn more." from Who We Are? That's a call to action; maybe considered boilerplate? It's not essential. Might be okay to keep? The instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. "Visit gomotive.com to learn more." is navigation/link; could be considered navigation. Safer to omit. Also "Learn more about our benefits by visiting Motive Perks & Benefits" is navigation; omit. Now construct HTML. We'll start with a
for Who We Are description (excluding the visit link). Who We Are paragraph: "Motive empowers the people who run physical operations with tools to make their work safer, more productive, and more profitable. For the first time ever, safety, operations and finance teams can manage their drivers, vehicles, equipment, and fleet related spend in a single system. Combined with industry leading AI, the Motive platform gives you complete visibility and control, and significantly reduces manual workloads by automating and simplifying tasks. Motive serves nearly 100,000 customers – from Fortune 500 enterprises to small businesses – across a wide range of industries, including transportation and logistics, construction, energy, field service, manufacturing, agriculture, food and beverage, retail, and the public sector." We'll put that as
. Then
About the role
thenwith the role description: "We are hiring a Senior Manager, Security Operations to build, lead and grow Motive's SOC. This is a founding leadership role — you will shape the team, the tooling, the detection strategy and the operating model rather than inheriting a mature organization and maintaining it. Reporting to the CISO, you will own the full detection and response lifecycle: detection engineering, 24/7 incident response, threat hunting, threat intelligence, security analytics, and endpoint and workload security. The scope spans Motive's entire estate. Product and production environments cover the cloud infrastructure, services, APIs and data platforms behind Fleet Management, Driver Safety, Spend Management, Workforce Management and AI Vision, plus the connected device fleet. Enterprise and corporate systems cover endpoints, identity and SSO, SaaS applications, network, email and internal tooling. These estates have different telemetry, threat models and response constraints — you cannot contain a production workload the way you isolate a laptop — and a central part of this role is running them as one detection and response capability with one view of the adversary, because real attacks cross the boundary between them. The mandate is coverage: we want to detect everything that goes wrong. That is a deliberately high bar, and it is an engineering problem rather than a staffing problem. We expect this SOC to be built AI-first and data-driven from day one, designed around automation from the start rather than staffing a traditional tiered analyst model and layering automation on later. Success looks like a small, senior, highly leveraged team whose time goes to hard problems, not queue processing." Then
Responsibilities
then- with each
- .
Then
Requirements
then- with each
- .
Then
Benefits
then- with each benefit.
Benefits list: health, pharmacy, optical and dental care benefits, paid time off, sick time off, short term
- .
Then
- .
Then