Manager, Threat Operations

• Lead and develop MDR Team Leads and analysts through expectations, coaching, feedback, career development, and accountability
• Build leadership capability and succession within the operation
• Lead MDR operational delivery during APJ hours, including staffing, coverage, workload balancing, queue health, prioritization, and service-level commitments
• Monitor operational health, including demand, capacity, backlog, response times, investigation effort, quality, escalations, and operational risks
• Coordinate a global 24x7 MDR service across regions
• Ensure effective follow-the-sun operations through ownership, handovers, and escalation
• Drive consistent triage and investigation practices
• Maintain standards for investigation quality, case handling, documentation, customer communication, and operational processes
• Use operational data and metrics to drive staffing decisions, efficiency, quality, and customer outcomes
• Act as a senior escalation point for customer-impacting situations, complex investigations, service risks, and workload challenges
• Support major security incidents and high-severity customer situations
• Maintain contingency plans and operational resilience
• Build operational readiness through skills coverage, onboarding, training, knowledge management, playbooks, processes, tooling, and leadership coverage
• Lead readiness and change adoption for new detections, capabilities, tooling, automation, workflows, and processes
• Reduce operational friction through standardization, automation, tooling, or process redesign
• Partner with Threat Intelligence, Detection Engineering, Incident Response, Product, Engineering, and other teams
• Drive continuous improvement using operational data, analyst feedback, customer escalations, quality findings, and lessons learned
• Maintain operational priorities, risks, performance, improvement initiatives, and dependencies across teams
• Bring APJ perspectives into global MDR planning
• Work with MDR leadership on capacity planning, operational strategy, organizational priorities, and transformation initiatives

• 7+ years of experience in cybersecurity operations, Managed Detection and Response, Security Operations Center operations, incident response, or a related discipline
• At least 2 years leading people, teams, or operational functions
• Experience leading security operations in a high-volume, customer-facing environment
• Proven people-leadership experience, including coaching, performance management, career development, hiring, onboarding, and team development
• Experience developing Team Leads, senior analysts, or frontline leaders
• Experience operating within a global or 24x7 security operations environment
• Strong understanding of security operations and the lifecycle of triage, investigation, escalation, response, and customer communication
• Strong technical understanding of endpoint, network, cloud, identity, and security telemetry
• Experience managing operational and customer escalations
• Experience using operational metrics and data to identify issues and deliver measurable improvements
• Ability to improve operational efficiency through process simplification, standardization, automation, or technology
• Strong understanding of attacker tools, tactics, and techniques, including persistence, lateral movement, credential theft, ransomware, and defense evasion
• Working knowledge of the MITRE ATT&CK framework
• Experience working across Detection Engineering, Threat Intelligence, Incident Response, Product, Engineering, and customer-facing teams
• Strong judgment and decision-making skills
• Excellent written and verbal communication skills
• Relevant professional experience in cybersecurity, security operations, or a related discipline
• Formal qualifications and certifications are valued but not required where equivalent experience can be demonstrated
• Desired: experience leading MDR or security operations teams across Australia and/or APJ
• Desired: experience with automation, AI-assisted capabilities, process redesign, or operational transformation
• CISSP, GCIH, CISM, or equivalent certifications are beneficial but not required

• Remote-first working model, with remote work as the primary option for most employees
• Employee-led diversity and inclusion networks
• Annual charity and fundraising initiatives
• Volunteer days
• Global employee sustainability initiatives
• Global fitness and trivia competitions
• Global wellbeing days
• Monthly wellbeing webinars and training
• Recruitment and selection adjustments to support applicants with disabilities or other needs